US6947989B2 - System and method for provisioning resources to users based on policies, roles, organizational information, and attributes - Google Patents
System and method for provisioning resources to users based on policies, roles, organizational information, and attributes Download PDFInfo
- Publication number
- US6947989B2 US6947989B2 US09/774,265 US77426501A US6947989B2 US 6947989 B2 US6947989 B2 US 6947989B2 US 77426501 A US77426501 A US 77426501A US 6947989 B2 US6947989 B2 US 6947989B2
- Authority
- US
- United States
- Prior art keywords
- user
- resources
- provisioning
- information
- resource
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Lifetime, expires
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/08—Configuration management of networks or network elements
- H04L41/0803—Configuration setting
- H04L41/0806—Configuration setting for initial configuration or provisioning, e.g. plug-and-play
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/08—Configuration management of networks or network elements
- H04L41/0893—Assignment of logical groups to network elements
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/08—Configuration management of networks or network elements
- H04L41/0894—Policy-based network configuration management
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/105—Multiple levels of security
Definitions
- the present invention relates, generally, to the administration of user accounts and resources, and, in preferred embodiments, to systems and processes for provisioning users with resources based on policies, roles, organizational information, and attributes.
- a common use of communication networks is to provide users access to network resources such as software, electronic data, or files in storage systems or databases connected to the network. As the number of users on a given network increases, there is often a need to control user access rights to resources on the network.
- Network environments often involve a variety of network users, where the users may be grouped or categorized by a relation or role that the user serves in the environment.
- users of the company's computer network may include company officers, directors, managers, engineers, technical support staff, office support staff, accounting department staff, information technology (IT) department staff, contractors, consultants, temporary employees or other relation-based or role-based groups or categories of network users.
- Other companies, organizations or network environments may have other relation or role-based groups of users.
- Each user may have a need to access certain network resources in connection with the user's relation or role.
- it may be desirable to restrict users with certain relations or roles from access to certain resources for example, for security, privacy or other reasons.
- resources may also be allocated to (or restricted from) users, based on the user's relation or role in the environment.
- resources such as telephones, telephone accounts, computers, Internet accounts, e-mail accounts, office equipment and supplies, laboratory or engineering equipment and supplies, or other resources, based on the user's role or relation with the company.
- the burden on the office administrator and office personnel to manually administer user access to resources in the above example is typically dependent on the size of the organization (the number of users) and the rate at which users join or leave the organization or otherwise change roles.
- some organizations have used software applications which automate or partially automate some of the tasks relating to provisioning certain, limited types of resources to users.
- Role Based Access Control is one form of automatic provisioning that has become commercially available.
- RBAC provides permissions (access rights) to a user to access certain accounts (files, web pages, etc.) available over the network, based on a person's role in the organization. For example, a file or folder may be viewed only by its creator, or may be accessible to a larger group of users through an organization's network, depending on the permission rights established for that file or folder. In conventional RBAC systems, these permissions are based on a person's role within the organization.
- embodiments of the present invention relate to systems and methods for provisioning users based on policies, user roles and attributes, which reduces or minimize the number of unique roles which must be created.
- Yet further embodiments of the present invention relate to systems and methods for provisioning resources in bundles.
- Yet further embodiments of the present invention relate to systems and methods for provisioning users based on policies that can take various process paths that are established as a result of the entry of user parameters.
- Yet further embodiments of the present invention relate to systems and methods for provisioning users based on policies which may require information or authorization from another person.
- the method and system involves establishing a set of attributes and user roles, and defining a plurality of resource access policies based on selected attributes and user roles.
- the method and system also involves receiving attribute information and user role information for a particular user or resource, determining which resource access policies are applicable to the user based on the received user role information and attribute information, and provisioning the user with resources based on the applicable resource access policies.
- the resources to be provisioned include “hard” resources as well as “soft” resources.
- Soft” resources may include e-mail and voice mail accounts, application programs, databases, files, folders, the Internet, Web pages, organizational Intranets, messages to third parties, digital certificates for enabling the user to access encrypted resources, the capability to order products over the Internet, the ability to order a corporate credit card, access to financial services providers, and the like.
- users may be provisioned with “hard” resources such as telephones, computers, cellular telephones, pagers, personal digital assistants, desks, chairs, file cabinets, other physical components, and the like.
- multiple resources may be bundled in one or more groups, such that users may be provisioned with resource bundles.
- FIG. 1 is a diagram of an external view of an Application Service Provider (ASP) environment embodiment of the present invention.
- ASP Application Service Provider
- FIG. 2 is a diagram of an external view of a Corporate Enterprise environment embodiment of the present invention.
- FIG. 3 is a diagram of logical architecture of a system according to an embodiment of the present invention.
- FIG. 4 is a diagram of a component arrangement of a system according to an embodiment of the present invention.
- FIG. 5 is a diagram of an example deployment of a system according to an embodiment of the present invention.
- FIG. 6 is a diagram of another example deployment of a system according to an embodiment of the present invention.
- FIGS. 7A-E are sequence diagrams of interactions relating to authenticating a user, adding a user, provisioning a service for a user, provisioning services for a new user based on policy, and synchronizing services and enforcing policy violations.
- FIG. 8 is diagram of graphical interfaces in a sequence relating to a provisioning process.
- embodiments of the present invention relate to a system operable on a communication network for provisioning users with resources based on policies, roles and attributes.
- Embodiments of the present invention will be generally referred to herein as a resource provisioning management (RPM) system, or simply “the system.”
- RPM resource provisioning management
- the system may be implemented with software applications and modules deployed on various processor or computer systems connected for communication over one or more network or non-network links.
- the processors in which the modules and applications are deployed may differ from system embodiment to system embodiment.
- the types of users, administrators and other entities that interact with the system may differ from system embodiment to system embodiment.
- Preferred embodiments of the system are designed to provide a high level of flexibility to accommodate the needs of a variety of potential applications of use.
- FIGS. 1 and 2 Two representative examples of system environments in which embodiments of the present invention operate are shown in FIGS. 1 and 2 , respectively.
- FIG. 1 shows a generalized representation of an Application Service Provider (ASP) environment embodiment
- FIG. 2 shows a generalized representation of an Enterprise environment embodiment of the system.
- a platform computer system 10 is coupled for communication with a plurality of user computers, administrator computers and other entities over a network 12 , depending upon the needs of the system.
- Further entities including external systems, databases and directories, third party service providers, managed services and system administrators may be coupled for communication to the platform system 10 through the same network or through other networks or dedicated communication links, depending upon the needs of the system. While a number of such entities are shown and described with respect to embodiments disclosed herein, it will be understood that further system environment embodiments of the invention need not include all of the entities described herein.
- the network environment may also include one or more network servers, routers and other network structure and devices (not shown).
- a network environment may comprise a local area network (LAN), for example, within an office or building.
- the network environment may comprise a wide area network (WAN) including, but not limited to, the Internet.
- LAN local area network
- WAN wide area network
- the platform system 10 may be implemented, for example, with one or more processors or computers which include or operate with associated memory and software modules and applications to carry out various functions described herein.
- the platform system 10 carries out various functions associated with provisioning users with resources based on policies, roles, organizational information, and attributes, as described below. Further functions may be carried out on processors or computers associated with the users, administrators, and service providers, for example, implemented by software running on those computers, as described below.
- Embodiments of the present invention can therefore run on a cluster of computers or on a single computer. These computers may or may not have multiple processors.
- Users, and users acting in administrator roles may operate computers which may include suitable processors, memory devices and user interface devices, such as, but not limited to, display devices, keyboards, mouse devices, or the like, to allow users to obtain and communicate information over the network or other communication link.
- Suitable software may be stored at, or be accessible to, the user and administrator Web browsers or computers, to provide user and administrator interface functions and to allow communication of electronic information and content, such as data, files, programs and other software over the network, in accordance with well known network communication technology.
- software for implementing functions associated with the user and administrator according to embodiments of the present invention may also be stored at, or be accessible to, the user and administrator Web browsers, respectively.
- the system 10 provides a platform for defining policies and provisioning services to a user interacting with the system, or a user interacting with the network on which the system is operating.
- the system may designate and track the types of services as well as the types of access to these services for a large number of users.
- the platform system 10 may receive requests for services from user computers.
- the platform system 10 may also receive information from administrator computers relating to, for example, authorizations of users' requests or changes in users, policies or roles.
- the platform system 10 may also provide information to the administrator Web browsers or computers, including, for example, reports on operation and service usage.
- the platform system 10 may provide requests, instructions, or other information to service providers or managed services computers related to providing services to the users, based on user requests, policies, roles, organizational information, and attributes.
- the platform system 10 may control access to services, such as data, files, programs or other electronic information from database or storage systems to the users, based on user requests, policies, roles, organizational information, and attributes.
- An ASP may be described as an organization that deploys, hosts and manages access to applications such as software and other resources to multiple parties from a centrally managed facility.
- the applications are typically delivered over networks, including, but not limited to the Internet, on a subscription basis.
- RPM system administrators 14 In the ASP environment, one or more users within the ASP may be designated as RPM system administrators 14 with access rights greater than other users at the same company.
- RPM system administrators like other users at the same company, are capable of performing operations in accordance with policies put in place by the ASP customer, which may be based on role and organizational information for each user.
- these RPM system administrators are additionally provided with certain system configuration responsibilities, including selecting the processors on which certain modules or applications of the system are deployed, as described below.
- an RPM system administrator may be able to manage, for example, organizations, users, services, roles, workflow rules, policies and the system itself.
- An RPM provisioning system administrator may also generate reports to audit the current and historical status of the system, and may also be authorized to manage different portions of the system's data by being granted permission to access such data.
- the responsibilities of any given RPM system administrator may range from organization management only, to entire system management, depending upon the permission or access rights provided to the given RPM system administrator.
- the system in FIG. 1 may also interface, for example, with one or more Customer End-Users 16 , Customer Administrators 18 , and Customer Supervisors 20 .
- the interfaces for the Customer End-User 16 , Customer Administrator 18 , and Customer Supervisor 20 are Web enabled for connection over the Internet 12 .
- a Customer End-User 16 is a user having access to resources in accordance with policies put in place by the customer
- a Customer End-User 16 may be an employee of an ASP's customer who is provided access to certain ASP resources.
- a Customer End-User 16 would typically be authorized only to perform self-administration of its own personal and account information stored in a Lightweight Directory Access Protocol (LDAP) Directory server (not shown in FIG. 1 ) by communicating requests for provisioned services/resources over the network using a Web browser.
- LDAP Lightweight Directory Access Protocol
- a Customer Administrator 18 is also a user having access to resources in accordance with policies put in place by the customer.
- a Customer Administrator 18 may be an employee of an ASP's customer who is responsible for administering portions of a customer's organization, such as managing organizational and user information and, is therefore provided with permissions or access rights to appropriate system data to perform such functions.
- a Customer Administrator may define and manage use of user roles and policies and, thus, may be provided with permission or access rights to the LDAP Directory Server.
- a Customer Administrator may define or change users, roles, policies, organization hierarchy or the like.
- a Customer Administrator may also generate reports to audit the current and historical status of the system, and therefore may be provided with permission or access rights to the RPM system server containing a report engine 150 (see FIG. 3 ).
- a Customer Administrator 18 typically would be authorized to manage different portions of the system's data by being granted permission to access such data. The responsibilities of a Customer Administrator 18 may range from organization management only, to entire system management, depending upon the permission rights granted to the Customer Administrator.
- a Customer Supervisor 20 is also a user having access to resources in accordance with policies put in place by the customer.
- a Customer Supervisor 20 may be an employee of an ASP's customer who is responsible for managing or supervising groups of users in the customer organization.
- a Customer Supervisor 20 may delegate responsibilities to another Customer Supervisor. In preferred embodiments, the delegation of responsibility may be authorized for a pre-defined period of time.
- a Customer Supervisor 20 may make changes to a roster of current users and approve requests made by users, where such requests require approval.
- a Customer Supervisor 20 may also generate reports to audit the current and historical status of the system. It should be understood that, in preferred embodiments, reports are not stored. Rather, they are generated as needed, and if a user wants to store a report, it would have to be saved to the user's Web browser.
- FIG. 1 also indicates that the system may interface with one or more External Systems 22 .
- An External System 22 may be any ASP system that may wish to retrieve customer or managed resource information that is managed by the system 10 . This may be accomplished via a direct interface to an RPM directory (see reference character 58 in FIG. 3 ) used by the system 10 to store such information.
- the system may also interface with one or more Customer Datastores 24 .
- this interface is Internet capable.
- a Customer Datastore 24 may be a relational database or directory that stores ASP customer information. Note that customer-relevant data such as the customer's organization, roles, account information, and user information is stored in the directories within the Customer Datastores 24 , while in-progress workflow information, audit logs, historical audit trail information (e.g., requests that have been approved), system state information (e.g. workflow state, requests that have not yet been approved), and information about remote services is stored in the databases within the Customer Datastores 24 .
- the system 10 may also interface, for example, with a Managed Service 26 , as shown in FIG. 1 .
- a Managed Service 26 may be an application, device or datastore that the system 10 proactively manages.
- a Managed Service may comprise a network device that has an account maintenance system, such as an RPM system, an operating system, an application (e.g., a human resources (HR) system, enterprise resource planning (ERP) system, etc.), public key infrastructure (PKI) certificates, databases, financial services, and the like.
- the Managed Service's system may function independently.
- the datastore for the system 10 and that of a Managed Service may be synchronized periodically or at defined or irregular intervals, for example, to update the datastore.
- the system may also interface, for example, with a Third Party Service Provider 28 , as shown in FIG. 1 .
- this interface is Internet capable.
- a Third Party Service Provider 28 may be an external organization that provides services that may be provisioned through the system 10 .
- a Third Party Service Provider 28 may be, for example, a credit card service that provides credit cards or credit accounts that are provisioned through the system 10 .
- a Third Party Service Provider 28 may be a telephone service company that provides telephone line accounts that are provisioned through the system 10 . It should be understood that these are merely representative examples. Many other types of services may be provided by a Third Party Service Provider in accordance with further system embodiments.
- the system 10 may also interface, for example, with a Partner System 30 , as shown in FIG. 1 .
- this interface is Internet capable.
- a Partner System 30 may be similar or identical to the system 10 , but used by a business partner or customer and integrated into the system 10 .
- the Partner System 30 represents a system-to-system interface which, in preferred embodiments, may be used to provide the seamless integration of multiple systems.
- FIG. 2 a system according to the embodiment of FIG. 2 is deployed in an Enterprise environment.
- An enterprise may be any organization that desires or requires management and administration of its resources, including, but not limited to, companies, firms, educational organizations, governmental organizations, or other groups or associations.
- the system 10 supports the same capabilities described above with respect to FIG. 1 , but with some differences for different kinds of users.
- the system 10 may interface with a System Administrator 50 in a manner similar to the RPM system administrator interface described with respect to FIG. 1 .
- the System Administrator 50 may be an employee of the Enterprise, and may have responsibility for configuring the system.
- a System Administrator 50 may be able to manage organizations, users, services, roles, workflow rules, policies, and the system itself.
- a System Administrator 50 may also generate reports to audit the current and historical status of the system.
- a System Administrator 50 may be authorized to manage different portions of the system's data by being granted permission to access such data.
- the responsibilities of a System Administrator 50 may range from organization management only, to entire system management.
- the environment in FIG. 2 includes Employees (or Partners) 52 , Employee Administrators 54 , and Supervisors 56 .
- Each may interface with the system 10 , and are preferably web enabled for interfacing with system 10 over the Internet.
- An Employee may be an employee of the enterprise.
- An Employee 52 is a user having access to resources in accordance with policies put in place by the enterprise. Typically, an Employee may only be authorized to perform self-administration of the Employee's own personal information.
- An Employee Administrator 54 may be an employee of the Enterprise who is responsible for Enterprise employee administration.
- An Employee Administrator 54 is a user having access to resources in accordance with policies put in place by the Enterprise, who is responsible for managing the Enterprise's organizational and user information. This may involve defining, changing and managing user roles and policies.
- An Employee Administrator 54 may also generate reports to audit the current and historical status of the system.
- An Employee Administrator 54 may be authorized to manage different portions of the system's data by being granted permission to access such data. The responsibilities of an Employee Administrator 54 may range from organization management only, to entire system management.
- An Enterprise Supervisor 56 may be an employee of the Enterprise who is responsible for managing groups of users within the Enterprise. Typically, an Enterprise Supervisor 56 may make changes to users and approve requests made by users. An Enterprise Supervisor 56 may also generate reports to audit the current and historical status of the system.
- FIG. 2 also indicates that the system may interface with a Directory 58 .
- a Directory 58 may be used by the system to store organizational information, user or employee information, partner information, role information, account information, resource information or the like.
- the Directory is an LDAPv3 directory.
- the directory may be supplied by an Enterprise customer, or may be installed solely for the system 10 .
- a Human Resources Datastore 60 may be a database or directory that stores Enterprise employee and partner information.
- the system 10 may also interface with a Partner System 62 , Third Party Service Providers 64 and Managed Services 66 , in a manner similar to that described above with respect to the Partner Systems 30 , Third Party Service Providers 28 and Managed Services 26 in FIG. 1 .
- the system 10 in FIGS. 1 and 2 may be used to manage the provisioning of a variety of services or resources to users.
- a service may be any type of resource that may be accessed one or more times by users of the system.
- a cellular telephone account or an account with a credit card company may be services.
- the system may, for example, designate that certain users have access to a cellular telephone account and a credit card account, and may track the usage by the user of these accounts.
- the system may also set various rules and policies regarding the use of these accounts by the user, depending on the status of the user.
- an organization may provision, or allocate, services to a user within the organization based on defined policies, organizational information, attributes, and the role of the user in the organization.
- the policies, or rules may be pre-defined for the organization based on the needs of the organization and incorporated into the system.
- the policies may be flexible enough to account for the various roles within the organization and the services each role requires. For example, assume an organization hires a new employee in the capacity of System Administrator. Using the system, several actions may be automatically initiated.
- a pre-set policy for the organization provides that each employee receives regular telephone service, a regular telephone, and an e-mail account
- the system upon the hiring of a new System Administrator, the system will automatically notify the appropriate parties to set up a regular telephone account and an e-mail account for the System Administrator and deliver a regular telephone to the System Administrator's office.
- a pre-set policy for the organization is that each System Administrator has access to all system databases. The system will then automatically grant the System Administrator access to all system databases.
- Preferred embodiments of the system described herein perform these actions automatically based on the role of the person within the organization and policies that are pre-defined for the organization.
- the policies may be based on the needs of the organization and the requirements of each particular role within the organization, such that resources may be provisioned to each user to meet the needs and the requirements of the user's particular role in the organization.
- FIG. 3 A logical architecture view of applications and modules of a system 10 according to one embodiment of the present invention is shown in FIG. 3 .
- an example system embodiment may be characterized as a group of software modules with interfaces that allow the modules to collaborate with each other in order to implement the features of the system.
- each module may be a self-contained unit of software that may be replaced within the system without compromising the integrity of the system, as long as the interface of the replaced module is maintained. While the interface to the module may remain consistent, the internal architecture of each module may vary, depending upon the application of use.
- the modules may be grouped into an applications subsystem 102 and a platform subsystem 104 .
- the applications subsystem 102 is directed toward applications that help a user or an administrator perform specific functions and, thus, may be implemented in software running on computers operated by users or administrators.
- the platform subsystem is directed toward services and utilities for enabling applications to interact with directories and databases containing the state of a network and the services on that network that are being managed.
- the platform subsystem may be implemented in software running on the platform computer system.
- the applications subsystem 102 may include, for example, administration applications 106 , application framework 108 and user applications 110 .
- Administration applications 106 are applications used by an administrator, via the network, for various administration purposes. These applications may include one or more System Configuration applications 112 , which provide an interface to allow an administrator to configure certain properties of the system. For example, the administrator interface may allow administrators to make system configuration settings, including, but not limited to, directory communication settings, logging properties, e-mail service settings, and garbage collection settings.
- the System Configuration applications 112 may include an interface to a Form Generation application 114 , invoked to provide custom forms for data managed by the system. An example of such a form is illustrated in FIG. 8 .
- the Form Generation application 114 may also allow an administrator to create custom forms to be displayed in user and administrator applications.
- the Form Generation application may comprise a graphical user interface builder that associates system data attributes with graphical controls, which may include, but is not limited to, a “What You See Is What You Get” (WYSIWYG) graphical user interface builder.
- the administration applications 106 may also include one or more Service Configuration applications 116 , which provide an interface to allow administrators to configure certain properties of a service managed by the system.
- properties of a managed service include, but are not limited to, network location (IP address and port number), encryption for use and management, administrator login (ID and password), and management protocols.
- a service may be bundled as a set with other services that are related through administrator-defined dependencies defined through the administrator interface.
- the Service Configuration applications 116 may include an interface to the Form Generation application 114 to provide custom forms for the account information to be used in the User Management web user application, which is the Web-based user interface that allows a user to add, modify, and delete other users.
- the application framework 108 comprises a framework that integrates administrator and user applications.
- the application framework may include one or more System Browser applications 118 , accessible by the system administrator, that preferably provide a graphical display of the entire managed contents of the system in a format that is easy to use.
- the user applications 110 are applications used by an end-user, over the network, for various purposes.
- the user applications 110 may include one or more Organization Management applications 120 that preferably provide a graphical display of an organization's hierarchy of data in a format that is easy to use. From this interface, organizational units, locations, business partner organizations, users, system roles and organizational roles in the form of a tree view can be constructed and altered.
- a user in a given organization will be restricted from accessing other organizations' data.
- a system administrator (not to be confused with an employee administrator or a customer administrator, described below) may be provided with access rights to all organizations' data.
- the user applications 110 may include one or more Request Management applications 122 that provide an interface for the user to review and manage change requests pending within the system.
- a change request is a request to change one or more attributes of a user, or a request to change one or more attributes of a service belonging to that user.
- the interface may allow, for example, users acting in a supervisory role to approve or disapprove change requests.
- the user applications 110 may also include one or more Form Viewer applications 124 that dynamically display forms as they are designed by the Form Generation administration application 114 .
- the access level of the user determines which form, if any, the Form Viewer application will display in different situations.
- One or more Report Viewer applications 126 may be included for allowing a user to instruct a Report Engine in the platform subsystem 104 to execute predefined reports, and for displaying the results to the user.
- the access level of the user determines which reports the Report Viewer will provide.
- the user applications include applications for allowing a user to submit a request for provisioned services.
- the user applications 110 may also include a Policy Management application 128 that provides an interface for defining policies that control the provisioning of services to users.
- policies determine an association between the users and the services or resources, and constraints on those services provisioned to the users, based on attributes and user roles.
- the policies may define one or a series of approvals that are required before provisioning a given service or any service to a user. For example, such approvals may be required from one or more other users acting in a supervisory role. Policies may require one or more approvals if an attribute constraint is violated.
- the approvals may be defined using a Workflow Management application 130 , which provides an interface for defining the approval process needed for a request in the system.
- the platform subsystem 104 includes service and utility modules that enable various applications of the system to interact with directories and databases that hold information relating to the state of the system and services available over the network.
- the platform subsystem 104 may include, for example, application services 132 , data services 134 and remote services 136 .
- the platform modules are designed to be as independent as possible of any domain-specific information. This enables the platform to be easily applied to a different domain and support a new set of applications without (or with minimal) re-architecture.
- the application services 132 includes modules that may be used by several other system applications (client applications) to perform a service. These service modules may provide a separate and independent set of capabilities to their client applications.
- the applications services modules 132 may include an Authorization module 138 for providing a set of authentication implementations that may be used by client applications. Such implementations may include, but are not limited to, simple password authentication techniques or X.509 certificate authentication.
- the application services 132 may also include an Authorization module 140 that provides an interface for authorized users to define authorization rules, and enforces those rules as client applications attempt operations on the system, such as requesting services or data. These rules may apply to accessing data within the system, as well as to operations that can be applied to the system data, such as add, modify, or delete operations.
- Authorization module 140 provides an interface for authorized users to define authorization rules, and enforces those rules as client applications attempt operations on the system, such as requesting services or data. These rules may apply to accessing data within the system, as well as to operations that can be applied to the system data, such as add, modify, or delete operations.
- a Business-To-Business (B2B) Gateway module 142 may be included to provide an interface to an external access management system such as the RPM system described herein, or a comparable third-party system.
- the B2B Gateway module 142 may provide an external system the ability to add, modify, delete and query user information.
- these functions may be performed through an open protocol such as, but not limited to, secure hypertext transport protocol (HTTPS) to enable secure communications through the Internet.
- HTTPS secure hypertext transport protocol
- requests made by external systems to carry out such functions may be stored in an RPM database or other storage facility 144 for auditing purposes.
- the applications services 132 may also include a Logging module 146 that provides a utility for logging information, such as alarms and historical events, into persistent storage (e.g. the RPM database 144 ) associated with the platform system.
- a Logging module 146 that provides a utility for logging information, such as alarms and historical events, into persistent storage (e.g. the RPM database 144 ) associated with the platform system.
- the applications services 132 may also include a Policy Engine 148 for executing policies that associate users with services.
- the Policy Engine 148 functions to determine whether or not provisioning requests conform to defined policies and to provide correct recovery procedures in the event that a policy is violated. If an approval is needed for a provisioning request, the Policy Engine 148 interfaces with a Workflow Engine 150 to notify and obtain authorization instructions from the appropriate authorization entity, which may be, for example, one or more users having pre-defined supervisory roles.
- the Workflow Engine 150 functions to execute and track transactions within the system. Such transactions may include provisioning and de-provisioning of services, user status changes, and the approval process associated with a provisioning request in the system.
- users with appropriate access levels may, through a client application, query the Workflow Engine for status information relating to a transaction (such as a provisioning request) being executed by the system.
- the applications services modules also include a Report Engine 152 for executing predefined reports and formatting requested information. Note that requests for reports will only come directly from users of the system or the system administrator. They will not come from other systems.
- the data services modules 136 includes modules that assist other modules in interacting with directories and databases that hold the network's state and the system's configuration.
- the data services modules 136 may include an Information Model 154 that provides a logical view of the data in persistent storage in a manner that is independent of the type of data source that holds the data.
- the model abstracts the details of the stored data into more usable constructs, such as Users, Groups and Services, by adding an object-oriented layer on top of the LDAP-based data model.
- the model may also provide an extendable interface to allow for customized attributes that correspond to these constructs.
- the data services modules 136 may also include a Meta-Data module 156 that provides an interface from which a client may discover the design of the directory schema.
- Meta-Data is data that defines the content of the actual data. This may be used by a client to manage the data in persistent storage with a dynamic approach.
- the remote services modules 134 provide interaction with external systems for provisioning and de-provisioning services. Synchronization of service information and user information, which is the process of making sure that the information stored on the remote service and the information stored in the RPM system match and is up to date, may also be performed by the remote services modules 134 .
- the remote services modules 134 may include a Message Transformation module 158 that provides utilities for defining and executing conversions of messages such as add, modify, delete, and search from one format to another.
- This module handles message formats, rather than delivery protocols.
- the actual protocols used are determined at run-time, and may include, but are not limited to, Remote Access Management Protocol (RAMP), Encrypted Socket Protocol (ESP), and Directory Access Markup Language over HTTPS (DAML/HTTPS).
- RAMP Remote Access Management Protocol
- ESP Encrypted Socket Protocol
- DAML/HTTPS Directory Access Markup Language over HTTPS
- the message transformation module 158 transforms between the data format used in the LDAP directory and the format used on the external system. Both formats are key value pairs, but the names of the keys must be mapped as part of the conversion process.
- the remote services modules 134 may also include a Provisioning module 160 for providing an abstraction layer for provisioning products and services through external systems.
- the abstraction layer hides the protocol being used from the provisioning system.
- the specific protocols used to perform the provisioning, such as those described above, are preferably isolated from the client of the module. In preferred embodiments, new provisioning protocols may be added to the module without disrupting the module interface.
- the remote services modules 134 also include a Synchronization module 162 that retrieves service information from external systems to keep the service information stored by the system up to date.
- the Synchronization module 162 may retrieve organizational information, such as organizational unit and user information.
- the module is preferably pre-set or configured to define the data needed, how to retrieve it, where to store it and how often to perform retrievals.
- the module may also define rules for resolving conflicts between information retrieved from an external system and currently stored data.
- FIG. 4 An example component view embodiment of the system is shown in FIG. 4 , wherein logical applications and modules of FIG. 3 are organized into system components.
- a component is a self-contained and independent software entity that can be deployed onto computer and networking hardware separately from other components within the system.
- applications and modules are arranged to form an Application Server component 202 , a B2B Server component 204 , a Service Server component 206 , a Synchronization Server component 208 , a Web Server component 210 and a Workflow Server component 212 .
- Each of these components is arranged in one of two domains, a trusted domain 214 and a demilitarized zone (DMZ) domain 216 , relative to an untrusted domain 218 .
- DMZ demilitarized zone
- a DMZ is a computer network (or a single computer) that is protected from a company's internal network (the trusted domain), but is accessible from the internet.
- the DMZ domain 216 contains systems that are accessible from the internet, and can access the internal network (trusted domain).
- the DMZ domain 216 will not typically contain any sensitive data or critical systems.
- the DMZ domain 216 is created so that even if a hacker breaks into the DMZ, the hacker would still have to break into the internal network from the DMZ. Although every effort is made to protect the DMZ from hackers, a security breach in the DMZ should not result in the theft or corruption of data, or in the loss of a critical system.
- the trusted domain which is the internal network, is considered much more sensitive. Any intrusion into the trusted domain is considered a serious breach of security.
- the Application Server component 202 is composed of modules for supporting users interacting with the system, for example, through the Web Server component 210 .
- the Application Server component 202 is coupled to the Web Server component 210 and the Workflow Server through secure connections, such as secure remote method invocation (RMI) connections.
- the Application Server component 202 includes the authentication, authorization, report engine and logging modules of the application services 132 and data services modules 136 shown in FIG. 3 .
- the Application Server component also executes logic for the presentation of the Application Services modules, so that the Web Server component may remain as simple as possible. This also provides a security boundary for the Application modules.
- each request to the Application Server (requests from users for provisioned services) is authenticated and authorized before it is executed.
- the Web Server component may remain in an untrusted domain.
- the B2B Server component 204 is composed of modules for providing an interface to external systems such as another provisioning system of the type described herein, or other third-party provisioning systems that may communicate requests to the platform system.
- the B2B Server component 204 includes the B2B Gateway module 142 and an Authentication module (see reference character 138 in FIG. 3 ) for authenticating B2B requests.
- the interface may be provided using a secure network protocol, such as HTTPS, for encrypting data transfer and for authentication of requestors. In preferred embodiments, all requesters must be authenticated and authorized before requests can be fulfilled.
- the B2B Server component 204 is also coupled to the Workflow Server 212 , preferably through a secure connection, such as a secure RMI connection.
- the Service Server component 206 is composed of modules for providing an interface to managed resources 26 and 66 , and services that issue unsolicited notices or asynchronous provisioning confirmations to the system.
- the Service Server component 206 may be connected to managed services resources 26 and 66 , through, for example, a DAML/HTTPS connection.
- the Service Server component 206 may be connected to databases, such as a customer database 24 , and third party service provider systems 28 and 64 , through suitable connections, which may comprise HTTPS connections or vendor-specific connections.
- the Service Server component 206 includes a Notification Gateway module which provides receiving logic that interacts with the Synchronization and Provisioning modules of the Synchronization Server 208 and the Workflow Server 212 components, respectively, through secure connections such as secure RMI connections.
- the separation of the Notification Gateway module from the Synchronization and Provisioning modules provides a security boundary between untrusted and trusted domains.
- the protocols used may be specific to the managed entity. In preferred embodiments, all requestors must be authenticated and authorized before passing on information to any modules in the trusted domain.
- the Synchronization Server component 208 includes modules for periodically synchronizing service information between the service providers 28 , 64 and a local data repository.
- the Synchronization Server component 208 is configured to adapt to the service provider's interfaces to extract desired information.
- the Synchronization Server component 208 includes the synchronization and message transformation modules of the remote services 134 , the authentication, authorization, and logging modules of the applications services 132 , and the data services modules 136 shown in FIG. 3 .
- the Web Server component 210 includes modules for providing users with a graphical interface.
- the Web Server component includes an Applications Presentation module, which creates Web pages for the end user, as well as the authentication module of the applications services module group 132 .
- the Web Server component is connected to client systems 16 , 52 , for example, over an HTML/HTTPS connection. Preferably, all clients are authenticated when making requests to the system.
- the Web Server may be configured to require password authentication, X.509 certificate authentication, or both, when using HTTPS.
- the Workflow Server component 212 includes modules for provisioning and de-provisioning services within the system.
- the Workflow Server component includes the policy engine, workflow engine, logging, email, authentication and authorization modules of the applications services module group 132 , as well as the data services modules 136 and the provisioning and message transforming modules of the remote services module group 134 .
- the components 202 - 212 of the FIG. 4 embodiment may be deployed in hardware (processor or computer systems) in a variety of manners.
- the components may be deployed on as few processors as possible, for example, to minimize system complexity and operational cost.
- some or all of the components may be separated and distributed to separate processors to maximize computing resources.
- Many of the modules and applications within components can also be distributed to further maximize computing capabilities.
- some or all of the components may be configured in clusters to take advantage of load balancing algorithms and fail-over capabilities.
- the responsibility of configuring the system deployment may be provided to a system administrator.
- applications, modules or components containing groups of applications or modules as described above may be provided to a system administrator, for example, in software form (such as on a computer readable storage medium), in hardware or firmware form (such as on circuit boards or cards to be installed in a computer system) or a combination thereof.
- the system administrator may then develop a deployment strategy that meets the organization's performance and security needs and deploy the appropriate modules on appropriate hardware devices to fit the desired strategy.
- the system administrator may be free to deploy all of the components of the system on one processor or distribute clusters of each component in almost any combination, if desired.
- FIG. 5 An example of simple deployment option is shown in FIG. 5 , where the six components 202 - 212 of FIG. 4 are clustered onto one processor 302 comprising the Platform system.
- processor 302 represents a server running the provisioning system according to embodiments of the present invention described herein.
- the Platform Processor 302 is coupled to external systems and clients over the network 306 , through a Web Server Load Balancer 308 .
- One or more Data Server processors 304 may be coupled to the platform processor 302 for deploying the RPM Directory and RPM Database.
- the Data Server processors 304 include a server running a relational database server and an LDAP directory server.
- the FIG. 5 embodiment demonstrates a simple deployment with a clustered deployment of servers that deploy all the components of the system.
- the load balancing algorithms dictate which components are running on specific processors. This deployment embodiment, however, may present security risks because the components are not deployed on separate hardware in separate trusted domains, as described above.
- FIG. 6 Another example of a deployment option is shown in FIG. 6 .
- the FIG. 6 deployment while more complex than the deployment shown in FIG. 5 , alleviates some of the security concerns associated with the FIG. 5 deployment.
- All components 210 , 204 and 206 shown in the DMZ domain in FIG. 4 that interface to external clients and systems via the Internet may be clustered on one or more dedicated Web Server processors 402 in FIG. 6 to create a boundary between untrusted and trusted domains, where the web client is in an untrusted domain and the rest of the system components are in a trusted domain.
- the Synchronization Server component 208 is deployed in a separate cluster, so that communication with the service providers can be configured independently of other clusters.
- the interfaces to external clients and systems are isolated to one or more servers containing only those components of the system necessary for external interface.
- Other components of the system including, but not limited to, those components that must remain secure, may reside on servers that do not interface to external clients and servers.
- external users of the system whose trustworthiness has not been verified are isolated from secure portions of the system, and the integrity of secure portions of the system residing on other servers within the system may be protected.
- an Approval Management functional area may group all requirements for user authentication to the system and the management of a user's access to functions and data within the system.
- a Business Partner functional area may group all requirements for managing business partner relationships.
- a Business-to-Business functional area may group all requirements for business-to-business interactions. This may include all external interfaces to partner and service subscriber systems.
- An External Data Input functional area may group all requirements for incorporating current customer information into the system, such as existing users and resources.
- An Organization Management functional area may group all requirements for adding, modifying, and deleting organizations.
- a Policy Based Provisioning functional area may group all requirements for defining the provisioning of services based on attributes or a users' membership in a role, group, organizational unit, or organization.
- a Report Generation functional area may group all requirements for reporting capabilities provided by the system.
- a Service Management functional area may group all requirements for defining services that the system may provision.
- a System Administration functional area may group all requirements for configuring the system. This may include requirements for installing the system and altering its configuration parameters.
- a User Interface Customization functional area may group all requirements for providing a user the ability to customize a user interface.
- a User Management functional area may group all requirements for adding, modifying, and deleting users.
- FIG. 7A is a sequence diagram of interactions for implementing a user's authentication to the system.
- the user is presented with an application interface to perform system actions.
- the user is presented an interface to an Organization Management application.
- FIG. 7B is a sequence diagram of interactions for adding a user to the system.
- FIG. 7C is a sequence diagram of interactions for implementing on-demand provisioning of a service for a user.
- FIG. 7D is a sequence diagram of interactions for synchronizing service data with a remote host and enforcing any policies that are violated by detecting changes made on the remote host.
- FIG. 7E is a sequence diagram of interactions for implementing an addition of a user to the system and provisioning of services for that user based on provisioning policies.
- user provisioning is accomplished with the RPM system described hereinabove.
- RBAC which provisions users with “soft” resources (such as accounts) based on only on roles
- RPM provisions users with both “hard” and “soft” resources based on policies, which are defined according to user roles and attributes.
- the RPM system may provision a user with “soft” resources, including, but not limited to passwords, e-mail and voice mail accounts, application programs, databases, files, folders, the Internet, Web pages, organizational Intranets, and the like.
- “soft” resources may include messages to third parties, digital certificates for enabling the user to access encrypted resources, the capability to order products over the Internet, the ability to order a corporate credit card, access to financial services providers, and the like.
- RPM may provision users with “hard” resources such as telephones, computers, cellular telephones, pagers, personal digital assistants, desks, chairs, file cabinets, and other physical components.
- RPM may also provide resource bundles, which are pre-packaged groupings of resources that are typically provisioned together.
- a resource bundle may include a cellular telephone, telephone service, a pager account, voice mail, and Internet access.
- Another example of a bundled account may be Digital Subscriber Line (DSL) access and an Internet Service Provider (ISP) account.
- DSL Digital Subscriber Line
- ISP Internet Service Provider
- RPM systems may also have the capability of making provisioning adjustments if a user's roles and attributes change, including de-provisioning, and especially de-provisioning all of the allocated resources once a user has left the company.
- the RPM system provisions users with resources based on policies, which are defined based on roles and attributes.
- a role describes a person's responsibility within the organization, and may include roles such as a manager, secretary, system administrator, committee member, and the like. Each role has only two values. For example, a user is either a manager (a “yes” value), or he is not (a “no” value).
- An attribute is a characteristic or quality of a user or resource, such as “amount of time spent traveling,” or “cost.” In contrast to a role, each attribute may have multiple values. For example, the attribute “amount of time spent traveling” may have the values “less than 30%,” “between 30% and 60%,” and “greater than 60%.”
- Role No. Definition 1 IF the user is in marketing AND the user is a manager AND the user travels less than 30% of the time, THEN provision the user with a pager; 2 IF the user is in marketing AND the user is a manager AND the user travels between 30% and 60% of the time, THEN provision the user with a cellular telephone; 3 IF the user is in marketing, THEN provision the user with access to the sales figures database;
- a new employee is a marketing manager that travels less than 30% of the time.
- a new employee, user B is a marketing manager that travels between 30% and 60% of the time.
- the role-based system would determine that roles 1 and 3 apply to user A, and that user A should be provisioned with a pager and access to the sales figures database.
- the role-based system would also determine that roles 2 and 3 apply to user B, and that user B should be provisioned with a cellular telephone and access to the sales figures database.
- Policy No. Definition 1 IF the user is in marketing AND the user is a manager, THEN IF the user travels less than 30% of the time, THEN provision the user with a pager; ELSE IF the user travels between 30% and 60% of the time, THEN provision the user with a cellular telephone; 2 IF the user is in marketing, THEN provision the user with access to the sales figures database;
- the policy-based system of would determine that roles 1 and 2 apply to user A, and that user A should be provisioned with a pager and access to the sales figures database.
- the policy-based system would also determine that roles 1 and 2 apply to user B, and that user B should be provisioned with a cellular telephone and access to the sales figures database.
- embodiments of the present invention allow a single policy to be defined than covers multiple attribute values, minimizing the number of policies that need to be defined as compared to the number of roles that would have to be defined in a role-based system.
- policy 1 of the policy-based system replaces roles 1 and 2 of the role-based system. With fewer policies to evaluate, less memory may be consumed.
- the determination of resources can be performed more quickly.
- both IF-THEN statements in roles 1 and 2 must be evaluated before the role-based system can determine that role 1 applies to user A, but role 2 does not.
- the ELSE IF statement in policy 1 can be bypassed.
- the roles and attributes associated with a user may be assigned by human resources personnel or other organizational employees prior to the user's start date.
- the provisioning of a user may be initiated by calling up a provisioning user interface (screen) on a Web browser connected to an organizational network. This screen would enable human resources personnel to input known roles and attributes.
- the RPM system would then search its stored policies and, based on the user's roles and attributes, determine a set of resources to be provisioned.
- human resources personnel may simply type employee information into a human resources (HR) system database, where the RPM system would automatically pull information from this database through a direct feed and begin the provisioning process.
- HR human resources
- a start date or other date and time information may be entered, and the RPM system can initiate provisioning tasks when triggered by this date and time information.
- the actual provisioning of resources may involve electronic communications and human interaction. For example, an e-mail might be sent to various office personnel to deliver a desk and chair to a certain office by a certain date. Another e-mail might be sent to IT personnel to deliver a computer and telephone to the office by a later date, and then enable a computer account, provide access to various applications and databases, e-mail, and voice mail by yet another date. Outside procurement services companies may also be contacted for some or all of the provisioning tasks.
- the provisioning of accounts maintained by an external system such as an ASP may be facilitated by communications between the RPM system and “agent” software that resides in a server within the external system.
- the “agent” acts as a portal through which accounts from the external system may be managed and accessed.
- a list of these existing resources is maintained by the RPM system. Thereafter, if a user's roles or attributes should change, the policies are re-evaluated and a new list of resources to be provisioned are determined. This new list of resources is compared to the list of existing resources, and users are provisioned or de-provisioned according to the differences in the lists. In preferred embodiments, if a particular existing resource is also in the new list of resources, the RPM system will make no change regarding this resource, rather than de-provisioning then provisioning the resource.
- embodiments of the present invention may also suspend the provisioning of resources, rather than de-provisioning them. For example, if a terminated user has threatened to take legal action against the company, the user's e-mail account may be suspended but not deleted, so that the user cannot access the e-mail account, but the e-mails may nevertheless be reviewed by the company in anticipation of litigation.
- a reconciliation process is performed when the RPM system is first invoked.
- the RPM system compares a list of currently provisioned resources with a list of resources that should have been provisioned based on the current state of each user's roles and attributes. Discrepancies between the two lists are resolved by provisioning or de-provisioning.
- the RPM system may also maintain attributes of resources.
- Resource attributes play a role where the provisioning process allows for a selection of resources. For example, once a user begins working at an organization, the user may be able to call up the provisioning user interface screen to request optional resources. After entering additional information, the user may be able to select optional resources, provided that the user has certain attribute values.
- user A a marketing manager that travels less than 30% of the time, and is not automatically entitled to a cellular telephone
- User A may call up the provisioning screen and inter a value of “Europe” for the attribute “client location.”
- the provisioning screen may then present user A with a selection of cellular telephones to choose from. If user A selects a cellular telephone less than $200, a “cellular telephone cost” attribute having a value “less than $200” will be associated with user A, and the system may automatically provision user A with that telephone by sending an e-mail order to a cellular telephone provider, for example.
- a “cellular telephone cost” attribute having a value “more than $200” will be associated with user A, and approval may be required.
- an e-mail may be sent to a vice-president, providing the vice-president with access to the provisioning screen and requesting that the vice-president input the approval or disapproval of the telephone.
- the RPM will either order the telephone or send a denial message to the user.
- An example policy definition covering this example is as follows:
- Policy No. Definition 1 IF the user is in marketing AND the user is a manager, THEN IF the user travels less than 30% of the time, THEN provision the user with a pager; IF the user's client's location is in Europe, THEN IF the cellular telephone is less than $200 Provision the user with the cellular telephone; ELSE approval from a vice-president is needed to provision the user with the cellular telephone; ELSE IF the user travels between 30% and 60% of the time, THEN provision the user with a cellular telephone;
- resource attributes include, but are not limited to, color, features, and manufacturer.
- embodiments of the present invention may require input from another person before provisioning can continue.
- human resources personnel may enter known roles and attributes, such as the new employee's department, at which time the policy may halt the inputting of information into the provisioning screen and instead send an e-mail to the department manager, providing the department manager with access to the provisioning screen and requesting that the department manager input a cubicle or office location.
- the policy may require that another person provide some of the new employee's roles, attributes, job descriptions, etc. before provisioning can resume.
- the provisioning process may be a sequence of steps, some of which require human intervention such as providing information or authorization.
- An example of this sequence will now be provided.
- a user wishing to be provisioned with one or more resources may access a provisioning user interface screen 700 from a networked computer.
- the provisioning screen 700 may include explanatory text and boxes or fields into which information may be entered.
- the user may type information into the fields, or may select from a pulldown menu of fixed choices. For example, fields 702 and 704 for a user to enter his first and last name may be provided, and a pulldown menu 706 of available resources may be provided.
- the provisioning screen 700 may also include fields for optional information, fields for required information that the requesting user does not know (and therefore must be provided by another person), fields for required information (such as approvals) that must be provided by another person, and the like. In preferred embodiments, however, the provisioning screen visible to the requesting user will only contain those fields for information that the user is capable of providing.
- the RPM processes the provisioning request by sending the provisioning screen to the manager, sending an e-mail to the manager to access a particular hyperlink to view the provisioning screen, or the like.
- the department manager may see a different provisioning screen 708 from the requesting user.
- the provisioning screen 708 may include additional fields 710 and 712 which allows the manager to approve or disapprove the request, and, if approval is given, which department has given the approval.
- the provisioning screen may then be made known to the IT department, who may see a different provisioning screen 714 from the department manager.
- the provisioning screen 714 may include an additional field 716 which allows IT personnel to designate a particular mail server, which may be dependent on the department information, and which may be beyond the department manager's knowledge.
- software for controlling the optional provisioning process may establish which information is to be provided by an individual, and which individuals have approval or disapproval authority, etc.
- the provisioning process may also determine who can modify information, and which information cannot be modified.
- the provisioning process may also define what information must be added before the provisioning request can be sent to the next person.
- the provisioning request may be sent back to the requesting user for additional information or the modification of existing information (i.e. the modification of a resource request).
- the authorizing authority may change depending on what is entered into the request fields. Thus, there is no one process path through which this request form will flow. The process path may actually branch into different directions, depending on what information is entered into the fields of the request form. A generic name for this flow is called workflow process.
- embodiments of the present invention to provide a system and method for provisioning users based on policies defined in terms of user roles and attributes, which minimizes the number of unique roles which must be created.
- embodiments of the present invention to provide a system and method for provisioning users based on policies which allow both “soft” and “hard” resources to be provisioned, as well as resource bundles.
- Embodiments of the present invention also provide a system and method for provisioning users based on policies which can take various process paths that are established as a result of the entry of user parameters, and may require information or authorization to be provided by another person.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Business, Economics & Management (AREA)
- Strategic Management (AREA)
- Physics & Mathematics (AREA)
- Computing Systems (AREA)
- Entrepreneurship & Innovation (AREA)
- General Physics & Mathematics (AREA)
- Human Resources & Organizations (AREA)
- Economics (AREA)
- Development Economics (AREA)
- Educational Administration (AREA)
- Quality & Reliability (AREA)
- Tourism & Hospitality (AREA)
- Marketing (AREA)
- General Business, Economics & Management (AREA)
- Game Theory and Decision Science (AREA)
- Operations Research (AREA)
- Databases & Information Systems (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Software Systems (AREA)
- Storage Device Security (AREA)
Abstract
Description
Role No. | |
1 | IF the user is in marketing AND the user is a manager AND |
the user travels less than 30% of the time, THEN | |
provision the user with a pager; | |
2 | IF the user is in marketing AND the user is a manager AND |
the user travels between 30% and 60% of the time, THEN | |
provision the user with a cellular telephone; | |
3 | IF the user is in marketing, THEN |
provision the user with access to the sales figures database; | |
Policy No. | |
1 | IF the user is in marketing AND the user is a manager, THEN |
IF the user travels less than 30% of the time, THEN | |
provision the user with a pager; | |
ELSE IF the user travels between 30% and 60% of the time, | |
THEN provision the user with a cellular telephone; | |
2 | IF the user is in marketing, THEN |
provision the user with access to the sales figures database; | |
Policy No. | |
1 | IF the user is in marketing AND the user is a manager, THEN |
IF the user travels less than 30% of the time, THEN | |
provision the user with a pager; | |
IF the user's client's location is in Europe, THEN | |
IF the cellular telephone is less than $200 | |
Provision the user with the cellular telephone; | |
ELSE | |
approval from a vice-president is needed to provision the user | |
with the cellular telephone; | |
ELSE IF the user travels between 30% and 60% of the time, | |
THEN provision the user with a cellular telephone; | |
Claims (19)
Priority Applications (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US09/774,265 US6947989B2 (en) | 2001-01-29 | 2001-01-29 | System and method for provisioning resources to users based on policies, roles, organizational information, and attributes |
EP02717378A EP1364331A1 (en) | 2001-01-29 | 2002-01-28 | System and method for resource provisioning |
PCT/US2002/002411 WO2002061653A2 (en) | 2001-01-29 | 2002-01-28 | System and method for resource provisioning |
JP2002561749A JP2005503596A (en) | 2001-01-29 | 2002-01-28 | Resource sharing system and method |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US09/774,265 US6947989B2 (en) | 2001-01-29 | 2001-01-29 | System and method for provisioning resources to users based on policies, roles, organizational information, and attributes |
Publications (2)
Publication Number | Publication Date |
---|---|
US20020147801A1 US20020147801A1 (en) | 2002-10-10 |
US6947989B2 true US6947989B2 (en) | 2005-09-20 |
Family
ID=25100732
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US09/774,265 Expired - Lifetime US6947989B2 (en) | 2001-01-29 | 2001-01-29 | System and method for provisioning resources to users based on policies, roles, organizational information, and attributes |
Country Status (1)
Country | Link |
---|---|
US (1) | US6947989B2 (en) |
Cited By (136)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20020123331A1 (en) * | 2001-03-04 | 2002-09-05 | Adomo, Inc. | Mobile communication system for a network |
US20020123342A1 (en) * | 2001-03-04 | 2002-09-05 | Adomo, Inc. | Mobile communication system for a network |
US20030126001A1 (en) * | 2001-12-28 | 2003-07-03 | Margo Northcutt | Process for managing requests for work within an organization through a centralized workflow management system |
US20030144860A1 (en) * | 2002-01-31 | 2003-07-31 | Fabio Casati | Dynamic conversation logic selection method and system |
US20040073569A1 (en) * | 2002-09-27 | 2004-04-15 | Sbc Properties, L.P. | System and method for integrating a personal adaptive agent |
US20040093526A1 (en) * | 2002-11-12 | 2004-05-13 | Hirsch Thomas Steven | Instrument access control system |
US20040230826A1 (en) * | 2003-03-14 | 2004-11-18 | Thomas Birkhoelzer | User objects for authenticating the use of electronic data |
US20040236728A1 (en) * | 2003-04-07 | 2004-11-25 | Newman Gary H. | Grouping of computers in a computer information database system |
US20040268146A1 (en) * | 2003-06-25 | 2004-12-30 | Microsoft Corporation | Distributed expression-based access control |
US20050039041A1 (en) * | 2001-11-14 | 2005-02-17 | Shaw Mari Myra | Access, identity, and ticketing system for providing multiple access methods for smart devices |
US20050055224A1 (en) * | 2003-09-04 | 2005-03-10 | Electronic Data Systems Corporation | System, method, and computer program product for managing interoperable data processing system services |
US20050132048A1 (en) * | 2003-12-12 | 2005-06-16 | International Business Machines Corporation | Role-based views access to a workflow weblog |
US20050131750A1 (en) * | 2003-12-12 | 2005-06-16 | International Business Machines Corporation | Method for tracking the status of a workflow using weblogs |
US20050159969A1 (en) * | 2004-01-21 | 2005-07-21 | Sheppard Robert F. | Managing information technology (IT) infrastructure of an enterprise using a centralized logistics and management (CLAM) tool |
US20050198021A1 (en) * | 2003-12-12 | 2005-09-08 | International Business Machines Corporation | Visualization of attributes of workflow weblogs |
US20050207553A1 (en) * | 2004-03-18 | 2005-09-22 | Alcatel | Service provisioning system |
US20060177013A1 (en) * | 2005-02-07 | 2006-08-10 | Heine Frifeldt | Form-based user interface for controlling messaging |
US20060177010A1 (en) * | 2005-02-07 | 2006-08-10 | Jens Skakkebaek | Caching user information in an integrated communication system |
US20060177009A1 (en) * | 2005-02-07 | 2006-08-10 | Jens Skakkebaek | Integrated multi-media communication system |
US20060177006A1 (en) * | 2005-02-07 | 2006-08-10 | Heine Frifeldt | Controlling messaging actions using form-based user interface |
US20060177025A1 (en) * | 2005-02-07 | 2006-08-10 | Heine Frifeldt | Integrating messaging server directory service with a communication system voice mail message interface |
US20060218394A1 (en) * | 2005-03-28 | 2006-09-28 | Yang Dung C | Organizational role-based controlled access management system |
US20060271783A1 (en) * | 2005-05-26 | 2006-11-30 | Wong Daniel M | Method and apparatus for authorizing a database operation |
US20070118527A1 (en) * | 2005-11-22 | 2007-05-24 | Microsoft Corporation | Security and data filtering |
WO2007088510A1 (en) | 2006-01-31 | 2007-08-09 | Koninklijke Philips Electronics N.V. | Role-based access control |
US20080005115A1 (en) * | 2006-06-30 | 2008-01-03 | International Business Machines Corporation | Methods and apparatus for scoped role-based access control |
US20080098485A1 (en) * | 2006-10-24 | 2008-04-24 | Avatier Corporation | Hybrid meta-directory |
US20080098484A1 (en) * | 2006-10-24 | 2008-04-24 | Avatier Corporation | Self-service resource provisioning having collaborative compliance enforcement |
US20080104244A1 (en) * | 2006-11-01 | 2008-05-01 | Paul Ming Chen | Provisioning of resources in a computer network |
WO2008054982A2 (en) * | 2006-10-31 | 2008-05-08 | Microsoft Corporation | Analyzing access control configurations |
US20080244688A1 (en) * | 2007-03-29 | 2008-10-02 | Mcclain Carolyn B | Virtualized federated role provisioning |
US20080263543A1 (en) * | 2003-12-04 | 2008-10-23 | Ramachandran Puthukode G | On-Demand active role-based software provisioning |
US20080313331A1 (en) * | 2007-06-12 | 2008-12-18 | Boykin James R | Managing Computer Resources In A Distributed Computing System |
US20090006975A1 (en) * | 2000-01-19 | 2009-01-01 | Corybant, Inc. | Distributive Real Time Information Dissemination and Information Gathering System and Service with Dynamically Harmonized Communication Channels |
US20090037870A1 (en) * | 2007-07-31 | 2009-02-05 | Lucinio Santos-Gomez | Capturing realflows and practiced processes in an IT governance system |
US20090205018A1 (en) * | 2008-02-07 | 2009-08-13 | Ferraiolo David F | Method and system for the specification and enforcement of arbitrary attribute-based access control policies |
US20090320092A1 (en) * | 2008-06-24 | 2009-12-24 | Microsoft Corporation | User interface for managing access to a health-record |
US20090328160A1 (en) * | 2006-11-03 | 2009-12-31 | Network Box Corporation Limited | Administration portal |
US7644008B1 (en) * | 2003-08-15 | 2010-01-05 | Sprint Communications Company L.P. | Web-based system and method for user role assignment in an enterprise |
US7724880B2 (en) | 2005-02-07 | 2010-05-25 | Avaya Inc. | Networked voicemail |
US7730523B1 (en) * | 2005-06-17 | 2010-06-01 | Oracle America, Inc. | Role-based access using combinatorial inheritance and randomized conjugates in an internet hosted environment |
US7752205B2 (en) | 2005-09-26 | 2010-07-06 | Bea Systems, Inc. | Method and system for interacting with a virtual content repository |
US20100185451A1 (en) * | 2009-01-16 | 2010-07-22 | Oracle International Corporation | Business-responsibility-centric identity management |
US7818344B2 (en) | 2005-09-26 | 2010-10-19 | Bea Systems, Inc. | System and method for providing nested types for content management |
US7904476B1 (en) | 2007-07-30 | 2011-03-08 | Hewlett-Packard Develpment Company, L.P. | Computer-implemented method for compressing representation of binary relation |
US7917537B2 (en) | 2005-09-26 | 2011-03-29 | Oracle International Corporation | System and method for providing link property types for content management |
US7953734B2 (en) | 2005-09-26 | 2011-05-31 | Oracle International Corporation | System and method for providing SPI extensions for content management system |
US20110202384A1 (en) * | 2010-02-17 | 2011-08-18 | Rabstejnek Wayne S | Enterprise Rendering Platform |
US8059793B2 (en) | 2005-02-07 | 2011-11-15 | Avaya Inc. | System and method for voicemail privacy |
US8064576B2 (en) | 2007-02-21 | 2011-11-22 | Avaya Inc. | Voicemail filtering and transcription |
US8107598B2 (en) | 2007-02-21 | 2012-01-31 | Avaya Inc. | Voicemail filtering and transcription |
US8160212B2 (en) | 2007-02-21 | 2012-04-17 | Avaya Inc. | Voicemail filtering and transcription |
US20120102201A1 (en) * | 2010-10-25 | 2012-04-26 | Hitachi, Ltd. | Storage apparatus and management method thereof |
US20120109701A1 (en) * | 2010-11-01 | 2012-05-03 | Bank Of America Corporation | Fulfillment Workflow Optimization |
US8175233B2 (en) | 2005-02-07 | 2012-05-08 | Avaya Inc. | Distributed cache system |
US8233594B2 (en) | 2005-02-07 | 2012-07-31 | Avaya Inc. | Caching message information in an integrated communication system |
US20120203824A1 (en) * | 2011-02-07 | 2012-08-09 | Nokia Corporation | Method and apparatus for on-demand client-initiated provisioning |
US8285720B2 (en) | 2003-04-07 | 2012-10-09 | Belarc, Inc. | Grouping of computers in a computer information database system |
US8375439B2 (en) | 2011-04-29 | 2013-02-12 | International Business Machines Corporation | Domain aware time-based logins |
US20130060659A1 (en) * | 2011-09-02 | 2013-03-07 | Oracle International Corporation | System and method for splitting collaboration on event metrics for a supplier to respond to based on functional role |
US8429191B2 (en) | 2011-01-14 | 2013-04-23 | International Business Machines Corporation | Domain based isolation of objects |
US8462922B2 (en) | 2010-09-21 | 2013-06-11 | Hartford Fire Insurance Company | Storage, processing, and display of service desk performance metrics |
US8463852B2 (en) | 2006-10-06 | 2013-06-11 | Oracle International Corporation | Groupware portlets for integrating a portal with groupware systems |
US8488751B2 (en) | 2007-05-11 | 2013-07-16 | Avaya Inc. | Unified messenging system and method |
US8559605B2 (en) | 2005-02-07 | 2013-10-15 | Avaya Inc. | Extensible diagnostic tool |
US20140122568A1 (en) * | 2012-10-30 | 2014-05-01 | Citigroup Technology, Inc. | Methods and Systems for Managing Directory Information |
US8719894B2 (en) | 2007-03-29 | 2014-05-06 | Apple Inc. | Federated role provisioning |
US8789132B2 (en) | 2010-06-07 | 2014-07-22 | Oracle International Corporation | Enterprise model for provisioning fine-grained access control |
US8788681B1 (en) * | 2008-08-25 | 2014-07-22 | Symantec Corporation | Method and apparatus for autonomously managing a computer resource using a security certificate |
US20140289796A1 (en) * | 2012-12-20 | 2014-09-25 | Bank Of America Corporation | Reconciliation of access rights in a computing system |
US20140289204A1 (en) * | 2013-03-19 | 2014-09-25 | International Business Machines Corporation | Executing a file backup process |
US8931057B2 (en) | 2006-10-24 | 2015-01-06 | Avatier Corporation | Apparatus and method for access validation |
US8938796B2 (en) | 2012-09-20 | 2015-01-20 | Paul Case, SR. | Case secure computer architecture |
US9081950B2 (en) | 2012-05-29 | 2015-07-14 | International Business Machines Corporation | Enabling host based RBAC roles for LDAP users |
US9092380B1 (en) * | 2007-10-11 | 2015-07-28 | Norberto Menendez | System and method of communications with supervised interaction |
US9141442B1 (en) | 2010-09-08 | 2015-09-22 | Dell Software Inc. | Automated connector creation for provisioning systems |
US9189643B2 (en) | 2012-11-26 | 2015-11-17 | International Business Machines Corporation | Client based resource isolation with domains |
US9230283B1 (en) | 2007-12-14 | 2016-01-05 | Consumerinfo.Com, Inc. | Card registry systems and methods |
US9256904B1 (en) | 2008-08-14 | 2016-02-09 | Experian Information Solutions, Inc. | Multi-bureau credit file freeze and unfreeze |
US9342783B1 (en) | 2007-03-30 | 2016-05-17 | Consumerinfo.Com, Inc. | Systems and methods for data verification |
USD759689S1 (en) | 2014-03-25 | 2016-06-21 | Consumerinfo.Com, Inc. | Display screen or portion thereof with graphical user interface |
USD759690S1 (en) | 2014-03-25 | 2016-06-21 | Consumerinfo.Com, Inc. | Display screen or portion thereof with graphical user interface |
USD760256S1 (en) | 2014-03-25 | 2016-06-28 | Consumerinfo.Com, Inc. | Display screen or portion thereof with graphical user interface |
US9400589B1 (en) | 2002-05-30 | 2016-07-26 | Consumerinfo.Com, Inc. | Circular rotational interface for display of consumer credit information |
US9405921B1 (en) | 2007-07-31 | 2016-08-02 | Hewlett Packard Enterprise Development Lp | Computer-implemented method for role discovery in access control systems |
US9406085B1 (en) | 2013-03-14 | 2016-08-02 | Consumerinfo.Com, Inc. | System and methods for credit dispute processing, resolution, and reporting |
US9443268B1 (en) | 2013-08-16 | 2016-09-13 | Consumerinfo.Com, Inc. | Bill payment and reporting |
US9477737B1 (en) | 2013-11-20 | 2016-10-25 | Consumerinfo.Com, Inc. | Systems and user interfaces for dynamic access of multiple remote databases and synchronization of data based on user rules |
US9483488B2 (en) | 2012-12-20 | 2016-11-01 | Bank Of America Corporation | Verifying separation-of-duties at IAM system implementing IAM data model |
US9529629B2 (en) | 2012-12-20 | 2016-12-27 | Bank Of America Corporation | Computing resource inventory system |
US9529851B1 (en) | 2013-12-02 | 2016-12-27 | Experian Information Solutions, Inc. | Server architecture for electronic data quality processing |
US9529989B2 (en) | 2012-12-20 | 2016-12-27 | Bank Of America Corporation | Access requests at IAM system implementing IAM data model |
US9536263B1 (en) | 2011-10-13 | 2017-01-03 | Consumerinfo.Com, Inc. | Debt services candidate locator |
US9537892B2 (en) | 2012-12-20 | 2017-01-03 | Bank Of America Corporation | Facilitating separation-of-duties when provisioning access rights in a computing system |
US9542553B1 (en) | 2011-09-16 | 2017-01-10 | Consumerinfo.Com, Inc. | Systems and methods of identity protection and management |
US9542433B2 (en) | 2012-12-20 | 2017-01-10 | Bank Of America Corporation | Quality assurance checks of access rights in a computing system |
US9607336B1 (en) | 2011-06-16 | 2017-03-28 | Consumerinfo.Com, Inc. | Providing credit inquiry alerts |
US9639594B2 (en) | 2012-12-20 | 2017-05-02 | Bank Of America Corporation | Common data model for identity access management data |
US9654541B1 (en) | 2012-11-12 | 2017-05-16 | Consumerinfo.Com, Inc. | Aggregating user web browsing data |
US9684905B1 (en) | 2010-11-22 | 2017-06-20 | Experian Information Solutions, Inc. | Systems and methods for data verification |
US9697263B1 (en) | 2013-03-04 | 2017-07-04 | Experian Information Solutions, Inc. | Consumer data request fulfillment system |
US9710852B1 (en) | 2002-05-30 | 2017-07-18 | Consumerinfo.Com, Inc. | Credit report timeline user interface |
US9721147B1 (en) | 2013-05-23 | 2017-08-01 | Consumerinfo.Com, Inc. | Digital identity |
US9830646B1 (en) | 2012-11-30 | 2017-11-28 | Consumerinfo.Com, Inc. | Credit score goals and alerts systems and methods |
US9853959B1 (en) | 2012-05-07 | 2017-12-26 | Consumerinfo.Com, Inc. | Storage and maintenance of personal data |
US9870589B1 (en) | 2013-03-14 | 2018-01-16 | Consumerinfo.Com, Inc. | Credit utilization tracking and reporting |
US9892457B1 (en) | 2014-04-16 | 2018-02-13 | Consumerinfo.Com, Inc. | Providing credit data in search results |
US10075446B2 (en) | 2008-06-26 | 2018-09-11 | Experian Marketing Solutions, Inc. | Systems and methods for providing an integrated identifier |
US10102570B1 (en) | 2013-03-14 | 2018-10-16 | Consumerinfo.Com, Inc. | Account vulnerability alerts |
US10102536B1 (en) | 2013-11-15 | 2018-10-16 | Experian Information Solutions, Inc. | Micro-geographic aggregation system |
US10127510B2 (en) | 2014-08-01 | 2018-11-13 | Oracle International Corporation | Aggregation-driven approval system |
US10169761B1 (en) | 2013-03-15 | 2019-01-01 | ConsumerInfo.com Inc. | Adjustment of knowledge-based authentication |
US10176233B1 (en) | 2011-07-08 | 2019-01-08 | Consumerinfo.Com, Inc. | Lifescore |
US10255598B1 (en) | 2012-12-06 | 2019-04-09 | Consumerinfo.Com, Inc. | Credit card account data extraction |
US10262364B2 (en) | 2007-12-14 | 2019-04-16 | Consumerinfo.Com, Inc. | Card registry systems and methods |
US10262362B1 (en) | 2014-02-14 | 2019-04-16 | Experian Information Solutions, Inc. | Automatic generation of code for attributes |
US10325314B1 (en) | 2013-11-15 | 2019-06-18 | Consumerinfo.Com, Inc. | Payment reporting systems |
US10373240B1 (en) | 2014-04-25 | 2019-08-06 | Csidentity Corporation | Systems, methods and computer-program products for eligibility verification |
US10521601B2 (en) | 2014-04-30 | 2019-12-31 | Sailpoint Technologies, Israel Ltd. | System and method for data governance |
US10621657B2 (en) | 2008-11-05 | 2020-04-14 | Consumerinfo.Com, Inc. | Systems and methods of credit information reporting |
US10630694B1 (en) | 2016-09-20 | 2020-04-21 | Express Scripts Strategic Development, Inc. | Systems and methods for data access control |
US10664936B2 (en) | 2013-03-15 | 2020-05-26 | Csidentity Corporation | Authentication systems and methods for on-demand products |
US10671749B2 (en) | 2018-09-05 | 2020-06-02 | Consumerinfo.Com, Inc. | Authenticated access and aggregation database platform |
US10685398B1 (en) | 2013-04-23 | 2020-06-16 | Consumerinfo.Com, Inc. | Presenting credit score information |
US20200267108A1 (en) * | 2017-07-28 | 2020-08-20 | Chengdu Qianniucao Information Technology Co., Ltd. | Method for user/staff member to acquire mail box account in system |
US10911234B2 (en) | 2018-06-22 | 2021-02-02 | Experian Information Solutions, Inc. | System and method for a token gateway environment |
US10963434B1 (en) | 2018-09-07 | 2021-03-30 | Experian Information Solutions, Inc. | Data architecture for supporting multiple search models |
US11227001B2 (en) | 2017-01-31 | 2022-01-18 | Experian Information Solutions, Inc. | Massive scale heterogeneous data ingestion and user resolution |
US11238656B1 (en) | 2019-02-22 | 2022-02-01 | Consumerinfo.Com, Inc. | System and method for an augmented reality experience via an artificial intelligence bot |
US11308186B1 (en) | 2021-03-19 | 2022-04-19 | Sailpoint Technologies, Inc. | Systems and methods for data correlation and artifact matching in identity management artificial intelligence systems |
US11315179B1 (en) | 2018-11-16 | 2022-04-26 | Consumerinfo.Com, Inc. | Methods and apparatuses for customized card recommendations |
US11461677B2 (en) | 2020-03-10 | 2022-10-04 | Sailpoint Technologies, Inc. | Systems and methods for data correlation and artifact matching in identity management artificial intelligence systems |
US11880377B1 (en) | 2021-03-26 | 2024-01-23 | Experian Information Solutions, Inc. | Systems and methods for entity resolution |
US11941065B1 (en) | 2019-09-13 | 2024-03-26 | Experian Information Solutions, Inc. | Single identifier platform for storing entity data |
US12015527B1 (en) * | 2023-02-16 | 2024-06-18 | Google Llc | Extensible method for organizational mapping via cloud resource consumption |
US12034729B2 (en) | 2021-10-11 | 2024-07-09 | Odna, Llc | System and method for computer system security authorization interfaces |
Families Citing this family (143)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7085834B2 (en) | 2000-12-22 | 2006-08-01 | Oracle International Corporation | Determining a user's groups |
US7802174B2 (en) | 2000-12-22 | 2010-09-21 | Oracle International Corporation | Domain based workflows |
US8015600B2 (en) | 2000-12-22 | 2011-09-06 | Oracle International Corporation | Employing electronic certificate workflows |
US7937655B2 (en) | 2000-12-22 | 2011-05-03 | Oracle International Corporation | Workflows with associated processes |
US7711818B2 (en) | 2000-12-22 | 2010-05-04 | Oracle International Corporation | Support for multiple data stores |
US7027408B2 (en) * | 2001-03-05 | 2006-04-11 | Qwest Communications International, Inc | Method and system for dynamic service profile integration by a service controller |
US20020166069A1 (en) * | 2001-05-04 | 2002-11-07 | Zendzian David M. | Network-monitoring system |
US7392546B2 (en) * | 2001-06-11 | 2008-06-24 | Bea Systems, Inc. | System and method for server security and entitlement processing |
US7031967B2 (en) * | 2001-08-06 | 2006-04-18 | Sun Microsystems, Inc. | Method and system for implementing policies, resources and privileges for using services in LDAP |
US20030033346A1 (en) * | 2001-08-10 | 2003-02-13 | Sun Microsystems, Inc. | Method, system, and program for managing multiple resources in a system |
US7133907B2 (en) * | 2001-10-18 | 2006-11-07 | Sun Microsystems, Inc. | Method, system, and program for configuring system resources |
US6965559B2 (en) * | 2001-10-19 | 2005-11-15 | Sun Microsystems, Inc. | Method, system, and program for discovering devices communicating through a switch |
JP4173447B2 (en) * | 2001-10-24 | 2008-10-29 | ビーイーエイ システムズ, インコーポレイテッド | Data synchronization |
US7225256B2 (en) | 2001-11-30 | 2007-05-29 | Oracle International Corporation | Impersonation in an access system |
US7287277B2 (en) * | 2001-12-21 | 2007-10-23 | Hewlett-Packard Development Company, L.P. | Method and apparatus for controlling execution of a computer operation |
US20030217036A1 (en) * | 2002-05-14 | 2003-11-20 | Argent Regulatory Services, L.L.C. | Online regulatory compliance system and method for facilitating compliance |
US20030135609A1 (en) * | 2002-01-16 | 2003-07-17 | Sun Microsystems, Inc. | Method, system, and program for determining a modification of a system resource configuration |
US7987421B1 (en) | 2002-01-30 | 2011-07-26 | Boyd H Timothy | Method and apparatus to dynamically provide web content resources in a portal |
US7890639B1 (en) * | 2002-01-30 | 2011-02-15 | Novell, Inc. | Method and apparatus for controlling access to portal content from outside the portal |
US7412374B1 (en) | 2002-01-30 | 2008-08-12 | Novell, Inc. | Method to dynamically determine a user's language for a network |
US7216163B2 (en) * | 2002-05-15 | 2007-05-08 | Oracle International Corporation | Method and apparatus for provisioning tasks using a provisioning bridge server |
US7840658B2 (en) * | 2002-05-15 | 2010-11-23 | Oracle International Corporation | Employing job code attributes in provisioning |
US7103889B2 (en) | 2002-07-23 | 2006-09-05 | Sun Microsystems, Inc. | Method, system, and article of manufacture for agent processing |
US20040024887A1 (en) * | 2002-07-31 | 2004-02-05 | Sun Microsystems, Inc. | Method, system, and program for generating information on components within a network |
US20040022200A1 (en) * | 2002-07-31 | 2004-02-05 | Sun Microsystems, Inc. | Method, system, and program for providing information on components within a network |
US7143615B2 (en) * | 2002-07-31 | 2006-12-05 | Sun Microsystems, Inc. | Method, system, and program for discovering components within a network |
US7424702B1 (en) | 2002-08-19 | 2008-09-09 | Sprint Communications Company L.P. | Data integration techniques for use in enterprise architecture modeling |
US20040039580A1 (en) * | 2002-08-19 | 2004-02-26 | Steger Kevin J. | Automated policy compliance management system |
EP1535444B1 (en) * | 2002-08-19 | 2013-04-17 | Research In Motion Limited | System and method for secure control of resources of wireless mobile communication devices |
US20040034659A1 (en) * | 2002-08-19 | 2004-02-19 | Steger Kevin J. | Automated policy compliance management system |
US7236977B1 (en) | 2002-09-20 | 2007-06-26 | Novell, Inc. | Method for dynamically distributing items for changes based on group membership |
US6836798B1 (en) * | 2002-12-31 | 2004-12-28 | Sprint Communications Company, L.P. | Network model reconciliation using state analysis |
US7779247B2 (en) | 2003-01-09 | 2010-08-17 | Jericho Systems Corporation | Method and system for dynamically implementing an enterprise resource policy |
US7660843B1 (en) | 2003-01-21 | 2010-02-09 | Novell, Inc. | Method and apparatus for dynamically delivering a gadget |
US8831966B2 (en) * | 2003-02-14 | 2014-09-09 | Oracle International Corporation | Method for delegated administration |
US7591000B2 (en) | 2003-02-14 | 2009-09-15 | Oracle International Corporation | System and method for hierarchical role-based entitlements |
US6917975B2 (en) * | 2003-02-14 | 2005-07-12 | Bea Systems, Inc. | Method for role and resource policy management |
US7653930B2 (en) | 2003-02-14 | 2010-01-26 | Bea Systems, Inc. | Method for role and resource policy management optimization |
JP4229735B2 (en) * | 2003-03-20 | 2009-02-25 | シャープ株式会社 | Information processing method, information processing system, management server, computer program, and recording medium |
US7389345B1 (en) | 2003-03-26 | 2008-06-17 | Sprint Communications Company L.P. | Filtering approach for network system alarms |
US9781154B1 (en) * | 2003-04-01 | 2017-10-03 | Oracle International Corporation | Systems and methods for supporting information security and sub-system operational protocol conformance |
US10063523B2 (en) | 2005-09-14 | 2018-08-28 | Oracle International Corporation | Crafted identities |
US10275723B2 (en) | 2005-09-14 | 2019-04-30 | Oracle International Corporation | Policy enforcement via attestations |
US7421493B1 (en) | 2003-04-28 | 2008-09-02 | Sprint Communications Company L.P. | Orphaned network resource recovery through targeted audit and reconciliation |
US7904487B2 (en) | 2003-10-09 | 2011-03-08 | Oracle International Corporation | Translating data access requests |
US7882132B2 (en) | 2003-10-09 | 2011-02-01 | Oracle International Corporation | Support for RDBMS in LDAP system |
US20050138419A1 (en) * | 2003-12-19 | 2005-06-23 | Pratik Gupta | Automated role discovery |
US8312145B2 (en) * | 2003-12-22 | 2012-11-13 | Rockstar Consortium US L.P. | Traffic engineering and bandwidth management of bundled links |
US7478421B2 (en) * | 2004-02-04 | 2009-01-13 | Toshiba Corporation | System and method for role based access control of a document processing device |
US20090119755A1 (en) * | 2004-02-04 | 2009-05-07 | Kodimer Marianne L | System and method for role based access control of a document processing device |
US7774601B2 (en) * | 2004-04-06 | 2010-08-10 | Bea Systems, Inc. | Method for delegated administration |
US7849438B1 (en) | 2004-05-27 | 2010-12-07 | Sprint Communications Company L.P. | Enterprise software development process for outsourced developers |
US20060037081A1 (en) * | 2004-08-13 | 2006-02-16 | Pelco | Method of and apparatus for controlling surveillance system resources |
US20060053478A1 (en) * | 2004-09-08 | 2006-03-09 | International Business Machines Corporation | System, method and computer program product for control of a service request |
US8078707B1 (en) * | 2004-11-12 | 2011-12-13 | Juniper Networks, Inc. | Network management using hierarchical domains |
US7607164B2 (en) * | 2004-12-23 | 2009-10-20 | Microsoft Corporation | Systems and processes for managing policy change in a distributed enterprise |
US7529931B2 (en) * | 2004-12-23 | 2009-05-05 | Microsoft Corporation | Managing elevated rights on a network |
US20060155716A1 (en) * | 2004-12-23 | 2006-07-13 | Microsoft Corporation | Schema change governance for identity store |
US20060143126A1 (en) * | 2004-12-23 | 2006-06-29 | Microsoft Corporation | Systems and processes for self-healing an identity store |
US20060177024A1 (en) * | 2005-02-07 | 2006-08-10 | Heine Frifeldt | Integrated voice mail user/email system user setup in integrated multi-media communication system |
US20060177011A1 (en) * | 2005-02-07 | 2006-08-10 | Jens Skakkebaek | System and method for providing code on voicemail appliance |
US7540014B2 (en) | 2005-02-23 | 2009-05-26 | Microsoft Corporation | Automated policy change alert in a distributed enterprise |
US7793284B2 (en) * | 2005-03-25 | 2010-09-07 | Microsoft Corporation | Role based server installation and configuration |
US20060236408A1 (en) * | 2005-04-14 | 2006-10-19 | International Business Machines Corporation | Method and apparatus for device dependent access control for device independent web content |
US7979859B2 (en) * | 2005-05-03 | 2011-07-12 | International Business Machines Corporation | Managing automated resource provisioning with a workload scheduler |
US8484065B1 (en) * | 2005-07-14 | 2013-07-09 | Sprint Communications Company L.P. | Small enhancement process workflow manager |
US20070100950A1 (en) * | 2005-11-03 | 2007-05-03 | William Bornstein | Method for automatic retention of critical corporate data |
US7895570B2 (en) * | 2005-12-22 | 2011-02-22 | International Business Machines Corporation | Accessible role and state information in HTML documents |
US9549064B2 (en) | 2006-08-28 | 2017-01-17 | Tp Lab Inc. | System and method to customize a telephone |
US8671444B2 (en) * | 2006-10-06 | 2014-03-11 | Fmr Llc | Single-party, secure multi-channel authentication for access to a resource |
US8434133B2 (en) * | 2006-10-06 | 2013-04-30 | Fmr Llc | Single-party, secure multi-channel authentication |
US8474028B2 (en) * | 2006-10-06 | 2013-06-25 | Fmr Llc | Multi-party, secure multi-channel authentication |
US20080115192A1 (en) * | 2006-11-07 | 2008-05-15 | Rajandra Laxman Kulkarni | Customizable authentication for service provisioning |
US20080120323A1 (en) * | 2006-11-17 | 2008-05-22 | Lehman Brothers Inc. | System and method for generating customized reports |
US9009777B2 (en) * | 2006-11-30 | 2015-04-14 | International Business Machines Corporation | Automatic role activation |
US20080243933A1 (en) * | 2007-03-30 | 2008-10-02 | Pseuds, Inc. | System and Method for Multi-Governance Social Networking Groups |
US8904391B2 (en) * | 2007-04-23 | 2014-12-02 | International Business Machines Corporation | Policy-based access control approach to staff activities of a business process |
US20080282262A1 (en) * | 2007-05-10 | 2008-11-13 | Microsoft Corporation | Automatic and configurable loading of loosely coupled service oriented software components |
US20090063216A1 (en) * | 2007-08-30 | 2009-03-05 | Bank Of America Corporation | On-Line Dynamic Certification |
US8539568B1 (en) | 2007-10-03 | 2013-09-17 | Courion Corporation | Identity map creation |
US8244761B1 (en) | 2007-10-18 | 2012-08-14 | United Services Automobile Association (Usaa) | Systems and methods for restricting access to internal data of an organization by external entity |
US7966665B1 (en) | 2007-11-16 | 2011-06-21 | Open Invention Network, Llc | Compliance validator for restricted network access control |
WO2009067704A2 (en) * | 2007-11-21 | 2009-05-28 | Motive, Incorporated | Role-based network service management |
WO2009076447A1 (en) * | 2007-12-10 | 2009-06-18 | Courion Corporaton | Policy enforcement using esso |
US8572043B2 (en) * | 2007-12-20 | 2013-10-29 | International Business Machines Corporation | Method and system for storage of unstructured data for electronic discovery in external data stores |
US8112406B2 (en) * | 2007-12-21 | 2012-02-07 | International Business Machines Corporation | Method and apparatus for electronic data discovery |
US8140494B2 (en) | 2008-01-21 | 2012-03-20 | International Business Machines Corporation | Providing collection transparency information to an end user to achieve a guaranteed quality document search and production in electronic data discovery |
US7523206B1 (en) * | 2008-04-07 | 2009-04-21 | International Business Machines Corporation | Method and system to dynamically apply access rules to a shared resource |
US20090286219A1 (en) * | 2008-05-15 | 2009-11-19 | Kisin Roman | Conducting a virtual interview in the context of a legal matter |
US8275720B2 (en) * | 2008-06-12 | 2012-09-25 | International Business Machines Corporation | External scoping sources to determine affected people, systems, and classes of information in legal matters |
US9830563B2 (en) | 2008-06-27 | 2017-11-28 | International Business Machines Corporation | System and method for managing legal obligations for data |
US8489439B2 (en) * | 2008-06-30 | 2013-07-16 | International Business Machines Corporation | Forecasting discovery costs based on complex and incomplete facts |
US8073729B2 (en) * | 2008-09-30 | 2011-12-06 | International Business Machines Corporation | Forecasting discovery costs based on interpolation of historic event patterns |
US8515924B2 (en) * | 2008-06-30 | 2013-08-20 | International Business Machines Corporation | Method and apparatus for handling edge-cases of event-driven disposition |
US8484069B2 (en) * | 2008-06-30 | 2013-07-09 | International Business Machines Corporation | Forecasting discovery costs based on complex and incomplete facts |
US20100017239A1 (en) * | 2008-06-30 | 2010-01-21 | Eric Saltzman | Forecasting Discovery Costs Using Historic Data |
US8327384B2 (en) | 2008-06-30 | 2012-12-04 | International Business Machines Corporation | Event driven disposition |
US8204869B2 (en) | 2008-09-30 | 2012-06-19 | International Business Machines Corporation | Method and apparatus to define and justify policy requirements using a legal reference library |
US8639920B2 (en) | 2009-05-11 | 2014-01-28 | Experian Marketing Solutions, Inc. | Systems and methods for providing anonymized user profile data |
US8966017B2 (en) | 2009-07-09 | 2015-02-24 | Novell, Inc. | Techniques for cloud control and management |
US8250041B2 (en) * | 2009-12-22 | 2012-08-21 | International Business Machines Corporation | Method and apparatus for propagation of file plans from enterprise retention management applications to records management systems |
US8655856B2 (en) * | 2009-12-22 | 2014-02-18 | International Business Machines Corporation | Method and apparatus for policy distribution |
US8548442B2 (en) * | 2010-01-11 | 2013-10-01 | Microsoft Corporation | Syndication of multiple service instances |
AU2012258340B2 (en) * | 2010-02-04 | 2014-04-17 | Accenture Global Services Limited | Web user interface |
US20110191254A1 (en) * | 2010-02-04 | 2011-08-04 | Accenture Global Services Gmbh | Web User Interface |
US20110208662A1 (en) * | 2010-02-19 | 2011-08-25 | Argent Consulting Services, Inc. | Systems and Methods for Regulatory Compliance |
US10255568B2 (en) | 2010-05-10 | 2019-04-09 | Tibco Software Inc. | Methods and systems for selecting a data transmission path for navigating a dynamic data structure |
US20110276358A1 (en) * | 2010-05-10 | 2011-11-10 | Tibco Software Inc. | Allocation of work items via queries of organizational structure and dynamic work item allocation |
US8910278B2 (en) * | 2010-05-18 | 2014-12-09 | Cloudnexa | Managing services in a cloud computing environment |
US8832148B2 (en) | 2010-06-29 | 2014-09-09 | International Business Machines Corporation | Enterprise evidence repository |
US8566903B2 (en) | 2010-06-29 | 2013-10-22 | International Business Machines Corporation | Enterprise evidence repository providing access control to collected artifacts |
US8402359B1 (en) | 2010-06-30 | 2013-03-19 | International Business Machines Corporation | Method and apparatus for managing recent activity navigation in web applications |
US8484186B1 (en) | 2010-11-12 | 2013-07-09 | Consumerinfo.Com, Inc. | Personalized people finder |
US9105009B2 (en) * | 2011-03-21 | 2015-08-11 | Microsoft Technology Licensing, Llc | Email-based automated recovery action in a hosted environment |
US8839257B2 (en) | 2011-11-22 | 2014-09-16 | Microsoft Corporation | Superseding of recovery actions based on aggregation of requests for automated sequencing and cancellation |
US9460303B2 (en) | 2012-03-06 | 2016-10-04 | Microsoft Technology Licensing, Llc | Operating large scale systems and cloud services with zero-standing elevated permissions |
US9047442B2 (en) * | 2012-06-18 | 2015-06-02 | Microsoft Technology Licensing, Llc | Provisioning managed devices with states of arbitrary type |
US8745718B1 (en) | 2012-08-20 | 2014-06-03 | Jericho Systems Corporation | Delivery of authentication information to a RESTful service using token validation scheme |
US8881249B2 (en) | 2012-12-12 | 2014-11-04 | Microsoft Corporation | Scalable and automated secret management |
US9277028B2 (en) * | 2013-02-06 | 2016-03-01 | Sap Portals Israel Ltd | Synchronizing user relationship across computer systems implementing workspaces |
US9600849B2 (en) * | 2013-03-12 | 2017-03-21 | Sap Portals Israel Ltd. | Providing multiple roles in computer-implemented workspaces |
US10129242B2 (en) * | 2013-09-16 | 2018-11-13 | Airwatch Llc | Multi-persona devices and management |
US9424429B1 (en) | 2013-11-18 | 2016-08-23 | Amazon Technologies, Inc. | Account management services for load balancers |
US9680872B1 (en) | 2014-03-25 | 2017-06-13 | Amazon Technologies, Inc. | Trusted-code generated requests |
US9854001B1 (en) | 2014-03-25 | 2017-12-26 | Amazon Technologies, Inc. | Transparent policies |
US10122757B1 (en) | 2014-12-17 | 2018-11-06 | Amazon Technologies, Inc. | Self-learning access control policies |
US10986131B1 (en) * | 2014-12-17 | 2021-04-20 | Amazon Technologies, Inc. | Access control policy warnings and suggestions |
US10043030B1 (en) | 2015-02-05 | 2018-08-07 | Amazon Technologies, Inc. | Large-scale authorization data collection and aggregation |
US20160232369A1 (en) * | 2015-02-11 | 2016-08-11 | Ricoh Company, Ltd. | Managing Access To Images Using Roles |
US9762585B2 (en) | 2015-03-19 | 2017-09-12 | Microsoft Technology Licensing, Llc | Tenant lockbox |
US20160330286A1 (en) * | 2015-05-08 | 2016-11-10 | Citrix Systems, Inc. | Systems and methods for using filters for groups of applications or users |
US10931682B2 (en) | 2015-06-30 | 2021-02-23 | Microsoft Technology Licensing, Llc | Privileged identity management |
US11425126B1 (en) * | 2015-09-30 | 2022-08-23 | Amazon Technologies, Inc. | Sharing of computing resource policies |
US20170279820A1 (en) * | 2016-03-24 | 2017-09-28 | Charles Dale Herring | System and method for detecting computer attacks |
US11687810B2 (en) | 2017-03-01 | 2023-06-27 | Carrier Corporation | Access control request manager based on learning profile-based access pathways |
US10880295B2 (en) * | 2017-03-06 | 2020-12-29 | Ssh Communications Security Oyj | Access control in a computer system |
CN107169365A (en) * | 2017-05-16 | 2017-09-15 | 成都牵牛草信息技术有限公司 | The establishing method of the form fields operating right of workflow and its approval node |
US11392649B2 (en) | 2018-07-18 | 2022-07-19 | Microsoft Technology Licensing, Llc | Binding query scope to directory attributes |
US11165776B2 (en) | 2018-08-28 | 2021-11-02 | International Business Machines Corporation | Methods and systems for managing access to computing system resources |
US11606391B2 (en) | 2019-02-28 | 2023-03-14 | Jpmorgan Chase Bank, N.A. | Method for controlling and provisioning resource access |
US11016789B2 (en) * | 2019-10-11 | 2021-05-25 | UiPath, Inc. | Robot browser embedding |
US11528279B1 (en) * | 2021-11-12 | 2022-12-13 | Netskope, Inc. | Automatic user directory synchronization and troubleshooting |
CN114465777B (en) * | 2021-12-31 | 2023-06-30 | 惠州华阳通用智慧车载系统开发有限公司 | TSP server access control method |
Citations (14)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP0697662A1 (en) * | 1994-08-15 | 1996-02-21 | International Business Machines Corporation | Method and system for advanced role-based access control in distributed and centralized computer systems |
US5826239A (en) * | 1996-12-17 | 1998-10-20 | Hewlett-Packard Company | Distributed workflow resource management system and method |
US6023765A (en) * | 1996-12-06 | 2000-02-08 | The United States Of America As Represented By The Secretary Of Commerce | Implementation of role-based access control in multi-level secure systems |
US6052723A (en) * | 1996-07-25 | 2000-04-18 | Stockmaster.Com, Inc. | Method for aggregate control on an electronic network |
US6055637A (en) * | 1996-09-27 | 2000-04-25 | Electronic Data Systems Corporation | System and method for accessing enterprise-wide resources by presenting to the resource a temporary credential |
US6067548A (en) * | 1998-07-16 | 2000-05-23 | E Guanxi, Inc. | Dynamic organization model and management computing system and method therefor |
US6085191A (en) * | 1997-10-31 | 2000-07-04 | Sun Microsystems, Inc. | System and method for providing database access control in a secure distributed network |
US6088679A (en) * | 1997-12-01 | 2000-07-11 | The United States Of America As Represented By The Secretary Of Commerce | Workflow management employing role-based access control |
US6182142B1 (en) * | 1998-07-10 | 2001-01-30 | Encommerce, Inc. | Distributed access management of information resources |
US6202066B1 (en) * | 1997-11-19 | 2001-03-13 | The United States Of America As Represented By The Secretary Of Commerce | Implementation of role/group permission association using object access type |
US6237036B1 (en) * | 1998-02-27 | 2001-05-22 | Fujitsu Limited | Method and device for generating access-control lists |
US6408336B1 (en) * | 1997-03-10 | 2002-06-18 | David S. Schneider | Distributed administration of access to information |
US20020156904A1 (en) * | 2001-01-29 | 2002-10-24 | Gullotta Tony J. | System and method for provisioning resources to users based on roles, organizational information, attributes and third-party information or authorizations |
US20020169876A1 (en) * | 2001-03-06 | 2002-11-14 | Curie Jeffrey C. | Method and system for third party resource provisioning management |
-
2001
- 2001-01-29 US US09/774,265 patent/US6947989B2/en not_active Expired - Lifetime
Patent Citations (14)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP0697662A1 (en) * | 1994-08-15 | 1996-02-21 | International Business Machines Corporation | Method and system for advanced role-based access control in distributed and centralized computer systems |
US6052723A (en) * | 1996-07-25 | 2000-04-18 | Stockmaster.Com, Inc. | Method for aggregate control on an electronic network |
US6055637A (en) * | 1996-09-27 | 2000-04-25 | Electronic Data Systems Corporation | System and method for accessing enterprise-wide resources by presenting to the resource a temporary credential |
US6023765A (en) * | 1996-12-06 | 2000-02-08 | The United States Of America As Represented By The Secretary Of Commerce | Implementation of role-based access control in multi-level secure systems |
US5826239A (en) * | 1996-12-17 | 1998-10-20 | Hewlett-Packard Company | Distributed workflow resource management system and method |
US6408336B1 (en) * | 1997-03-10 | 2002-06-18 | David S. Schneider | Distributed administration of access to information |
US6085191A (en) * | 1997-10-31 | 2000-07-04 | Sun Microsystems, Inc. | System and method for providing database access control in a secure distributed network |
US6202066B1 (en) * | 1997-11-19 | 2001-03-13 | The United States Of America As Represented By The Secretary Of Commerce | Implementation of role/group permission association using object access type |
US6088679A (en) * | 1997-12-01 | 2000-07-11 | The United States Of America As Represented By The Secretary Of Commerce | Workflow management employing role-based access control |
US6237036B1 (en) * | 1998-02-27 | 2001-05-22 | Fujitsu Limited | Method and device for generating access-control lists |
US6182142B1 (en) * | 1998-07-10 | 2001-01-30 | Encommerce, Inc. | Distributed access management of information resources |
US6067548A (en) * | 1998-07-16 | 2000-05-23 | E Guanxi, Inc. | Dynamic organization model and management computing system and method therefor |
US20020156904A1 (en) * | 2001-01-29 | 2002-10-24 | Gullotta Tony J. | System and method for provisioning resources to users based on roles, organizational information, attributes and third-party information or authorizations |
US20020169876A1 (en) * | 2001-03-06 | 2002-11-14 | Curie Jeffrey C. | Method and system for third party resource provisioning management |
Non-Patent Citations (4)
Title |
---|
David Ferraiolo and Richard Kuhn, Role-Based Access Controls, Proceedings of the 15<SUP>th </SUP>NIST-NSA National Computer Security Conference, Baltimore, Maryland, Oct. 13-16, 1992. |
Hitchens et al, "Design and Specification of Role Based Access Control Policies", IEEE, Aug. 2000. * |
NIST High Integrity Software Systems Assurance Webstie with link to NIST Research in Role Based Access Control http://hissa.nist.gov. |
Tari et al, "A Role-based Access Control for Intranet Security", IEEE, 1997. * |
Cited By (267)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8510367B2 (en) * | 2000-01-19 | 2013-08-13 | Corybant, Inc. | Distributive real time information dissemination and information gathering system and service with dynamically harmonized communication channels |
US20090006975A1 (en) * | 2000-01-19 | 2009-01-01 | Corybant, Inc. | Distributive Real Time Information Dissemination and Information Gathering System and Service with Dynamically Harmonized Communication Channels |
US20020123342A1 (en) * | 2001-03-04 | 2002-09-05 | Adomo, Inc. | Mobile communication system for a network |
US7296066B2 (en) | 2001-03-04 | 2007-11-13 | Adomo, Inc. | Mobile communication system for a network |
US7400879B2 (en) | 2001-03-04 | 2008-07-15 | Adomo, Inc. | Method for conducting mobile communications for a network |
US20020123331A1 (en) * | 2001-03-04 | 2002-09-05 | Adomo, Inc. | Mobile communication system for a network |
US20050039041A1 (en) * | 2001-11-14 | 2005-02-17 | Shaw Mari Myra | Access, identity, and ticketing system for providing multiple access methods for smart devices |
US20030126001A1 (en) * | 2001-12-28 | 2003-07-03 | Margo Northcutt | Process for managing requests for work within an organization through a centralized workflow management system |
US20030144860A1 (en) * | 2002-01-31 | 2003-07-31 | Fabio Casati | Dynamic conversation logic selection method and system |
US9400589B1 (en) | 2002-05-30 | 2016-07-26 | Consumerinfo.Com, Inc. | Circular rotational interface for display of consumer credit information |
US9710852B1 (en) | 2002-05-30 | 2017-07-18 | Consumerinfo.Com, Inc. | Credit report timeline user interface |
US20040073569A1 (en) * | 2002-09-27 | 2004-04-15 | Sbc Properties, L.P. | System and method for integrating a personal adaptive agent |
US20040093526A1 (en) * | 2002-11-12 | 2004-05-13 | Hirsch Thomas Steven | Instrument access control system |
US8250636B2 (en) | 2002-11-12 | 2012-08-21 | Emd Millipore Corporation | Instrument access control system |
US7661127B2 (en) * | 2002-11-12 | 2010-02-09 | Millipore Corporation | Instrument access control system |
US20100235896A1 (en) * | 2002-11-12 | 2010-09-16 | Millipore Corporation | Instrument access control system |
US7540032B2 (en) * | 2003-03-14 | 2009-05-26 | Siemens Aktiengesellschaft | User objects for authenticating the use of electronic data |
US20040230826A1 (en) * | 2003-03-14 | 2004-11-18 | Thomas Birkhoelzer | User objects for authenticating the use of electronic data |
US20040236728A1 (en) * | 2003-04-07 | 2004-11-25 | Newman Gary H. | Grouping of computers in a computer information database system |
US7657499B2 (en) * | 2003-04-07 | 2010-02-02 | Belarc, Inc. | Grouping of computers in a computer information database system |
US8285720B2 (en) | 2003-04-07 | 2012-10-09 | Belarc, Inc. | Grouping of computers in a computer information database system |
US7653936B2 (en) * | 2003-06-25 | 2010-01-26 | Microsoft Corporation | Distributed expression-based access control |
US20040268146A1 (en) * | 2003-06-25 | 2004-12-30 | Microsoft Corporation | Distributed expression-based access control |
US7644008B1 (en) * | 2003-08-15 | 2010-01-05 | Sprint Communications Company L.P. | Web-based system and method for user role assignment in an enterprise |
US20050055224A1 (en) * | 2003-09-04 | 2005-03-10 | Electronic Data Systems Corporation | System, method, and computer program product for managing interoperable data processing system services |
US20080263543A1 (en) * | 2003-12-04 | 2008-10-23 | Ramachandran Puthukode G | On-Demand active role-based software provisioning |
US20050131750A1 (en) * | 2003-12-12 | 2005-06-16 | International Business Machines Corporation | Method for tracking the status of a workflow using weblogs |
US20050198021A1 (en) * | 2003-12-12 | 2005-09-08 | International Business Machines Corporation | Visualization of attributes of workflow weblogs |
US8140691B2 (en) * | 2003-12-12 | 2012-03-20 | International Business Machines Corporation | Role-based views access to a workflow weblog |
US20050132048A1 (en) * | 2003-12-12 | 2005-06-16 | International Business Machines Corporation | Role-based views access to a workflow weblog |
US8417682B2 (en) | 2003-12-12 | 2013-04-09 | International Business Machines Corporation | Visualization of attributes of workflow weblogs |
US8423394B2 (en) | 2003-12-12 | 2013-04-16 | International Business Machines Corporation | Method for tracking the status of a workflow using weblogs |
US20050159969A1 (en) * | 2004-01-21 | 2005-07-21 | Sheppard Robert F. | Managing information technology (IT) infrastructure of an enterprise using a centralized logistics and management (CLAM) tool |
US8285578B2 (en) * | 2004-01-21 | 2012-10-09 | Hewlett-Packard Development Company, L.P. | Managing information technology (IT) infrastructure of an enterprise using a centralized logistics and management (CLAM) tool |
US20050207553A1 (en) * | 2004-03-18 | 2005-09-22 | Alcatel | Service provisioning system |
US7630480B2 (en) * | 2004-03-18 | 2009-12-08 | Alcatel | Service provisioning system |
US7885275B2 (en) | 2005-02-07 | 2011-02-08 | Avaya Inc. | Integrating messaging server directory service with a communication system voice mail message interface |
US8559605B2 (en) | 2005-02-07 | 2013-10-15 | Avaya Inc. | Extensible diagnostic tool |
US20060177013A1 (en) * | 2005-02-07 | 2006-08-10 | Heine Frifeldt | Form-based user interface for controlling messaging |
US20060177010A1 (en) * | 2005-02-07 | 2006-08-10 | Jens Skakkebaek | Caching user information in an integrated communication system |
US8233594B2 (en) | 2005-02-07 | 2012-07-31 | Avaya Inc. | Caching message information in an integrated communication system |
US8175233B2 (en) | 2005-02-07 | 2012-05-08 | Avaya Inc. | Distributed cache system |
US8391461B2 (en) | 2005-02-07 | 2013-03-05 | Avaya Inc. | Caching user information in an integrated communication system |
US20060177009A1 (en) * | 2005-02-07 | 2006-08-10 | Jens Skakkebaek | Integrated multi-media communication system |
US20060177006A1 (en) * | 2005-02-07 | 2006-08-10 | Heine Frifeldt | Controlling messaging actions using form-based user interface |
US20060177025A1 (en) * | 2005-02-07 | 2006-08-10 | Heine Frifeldt | Integrating messaging server directory service with a communication system voice mail message interface |
US7564954B2 (en) | 2005-02-07 | 2009-07-21 | Adomo, Inc. | Form-based user interface for controlling messaging |
US8059793B2 (en) | 2005-02-07 | 2011-11-15 | Avaya Inc. | System and method for voicemail privacy |
US7346150B2 (en) | 2005-02-07 | 2008-03-18 | Adomo, Inc. | Controlling messaging actions using form-based user interface |
US7907704B2 (en) | 2005-02-07 | 2011-03-15 | Avaya Inc. | Caching user information in an integrated communication system |
US7808980B2 (en) | 2005-02-07 | 2010-10-05 | Avaya Inc. | Integrated multi-media communication system |
US7330537B2 (en) | 2005-02-07 | 2008-02-12 | Adomo, Inc. | Integrating messaging server directory service with a communication system voice mail message interface |
US7321655B2 (en) | 2005-02-07 | 2008-01-22 | Adomo, Inc. | Caching user information in an integrated communication system |
US7724880B2 (en) | 2005-02-07 | 2010-05-25 | Avaya Inc. | Networked voicemail |
US20060218394A1 (en) * | 2005-03-28 | 2006-09-28 | Yang Dung C | Organizational role-based controlled access management system |
US20060271783A1 (en) * | 2005-05-26 | 2006-11-30 | Wong Daniel M | Method and apparatus for authorizing a database operation |
US7770006B2 (en) * | 2005-05-26 | 2010-08-03 | Oracle International Corporation | Method and apparatus for authorizing a database operation |
US7730523B1 (en) * | 2005-06-17 | 2010-06-01 | Oracle America, Inc. | Role-based access using combinatorial inheritance and randomized conjugates in an internet hosted environment |
US8316025B2 (en) | 2005-09-26 | 2012-11-20 | Oracle International Corporation | System and method for providing SPI extensions for content management system |
US7953734B2 (en) | 2005-09-26 | 2011-05-31 | Oracle International Corporation | System and method for providing SPI extensions for content management system |
US7752205B2 (en) | 2005-09-26 | 2010-07-06 | Bea Systems, Inc. | Method and system for interacting with a virtual content repository |
US7917537B2 (en) | 2005-09-26 | 2011-03-29 | Oracle International Corporation | System and method for providing link property types for content management |
US7818344B2 (en) | 2005-09-26 | 2010-10-19 | Bea Systems, Inc. | System and method for providing nested types for content management |
US20070118527A1 (en) * | 2005-11-22 | 2007-05-24 | Microsoft Corporation | Security and data filtering |
US8448240B2 (en) | 2006-01-31 | 2013-05-21 | Koninklijke Philips Electronics N.V. | Role-based access control |
WO2007088510A1 (en) | 2006-01-31 | 2007-08-09 | Koninklijke Philips Electronics N.V. | Role-based access control |
US20090019516A1 (en) * | 2006-01-31 | 2009-01-15 | Koninklijke Philips Electronics N.V. | Role-based access control |
US20080005115A1 (en) * | 2006-06-30 | 2008-01-03 | International Business Machines Corporation | Methods and apparatus for scoped role-based access control |
US8458337B2 (en) | 2006-06-30 | 2013-06-04 | International Business Machines Corporation | Methods and apparatus for scoped role-based access control |
US20080243856A1 (en) * | 2006-06-30 | 2008-10-02 | International Business Machines Corporation | Methods and Apparatus for Scoped Role-Based Access Control |
US8463852B2 (en) | 2006-10-06 | 2013-06-11 | Oracle International Corporation | Groupware portlets for integrating a portal with groupware systems |
US20080098484A1 (en) * | 2006-10-24 | 2008-04-24 | Avatier Corporation | Self-service resource provisioning having collaborative compliance enforcement |
US9313207B2 (en) | 2006-10-24 | 2016-04-12 | Avatier Corporation | Apparatus and method for access validation |
US20080098485A1 (en) * | 2006-10-24 | 2008-04-24 | Avatier Corporation | Hybrid meta-directory |
US7950049B2 (en) | 2006-10-24 | 2011-05-24 | Avatier Corporation | Hybrid meta-directory |
US8931057B2 (en) | 2006-10-24 | 2015-01-06 | Avatier Corporation | Apparatus and method for access validation |
WO2008052084A2 (en) * | 2006-10-24 | 2008-05-02 | Avatier Corporation | Self-service resource provisioning having collaborative compliance enforcement |
US7707623B2 (en) * | 2006-10-24 | 2010-04-27 | Avatier Corporation | Self-service resource provisioning having collaborative compliance enforcement |
WO2008052084A3 (en) * | 2006-10-24 | 2008-10-09 | Avatier Corp | Self-service resource provisioning having collaborative compliance enforcement |
WO2008054982A2 (en) * | 2006-10-31 | 2008-05-08 | Microsoft Corporation | Analyzing access control configurations |
WO2008054982A3 (en) * | 2006-10-31 | 2008-07-17 | Microsoft Corp | Analyzing access control configurations |
US8452873B2 (en) | 2006-11-01 | 2013-05-28 | International Business Machines Corporation | Provisioning of resources in a computer network |
US20080104244A1 (en) * | 2006-11-01 | 2008-05-01 | Paul Ming Chen | Provisioning of resources in a computer network |
US20090328160A1 (en) * | 2006-11-03 | 2009-12-31 | Network Box Corporation Limited | Administration portal |
US8107598B2 (en) | 2007-02-21 | 2012-01-31 | Avaya Inc. | Voicemail filtering and transcription |
US8064576B2 (en) | 2007-02-21 | 2011-11-22 | Avaya Inc. | Voicemail filtering and transcription |
US8160212B2 (en) | 2007-02-21 | 2012-04-17 | Avaya Inc. | Voicemail filtering and transcription |
US20080244688A1 (en) * | 2007-03-29 | 2008-10-02 | Mcclain Carolyn B | Virtualized federated role provisioning |
US8719894B2 (en) | 2007-03-29 | 2014-05-06 | Apple Inc. | Federated role provisioning |
US8156516B2 (en) | 2007-03-29 | 2012-04-10 | Emc Corporation | Virtualized federated role provisioning |
US9473499B2 (en) | 2007-03-29 | 2016-10-18 | Apple Inc. | Federated role provisioning |
US9342783B1 (en) | 2007-03-30 | 2016-05-17 | Consumerinfo.Com, Inc. | Systems and methods for data verification |
US11308170B2 (en) | 2007-03-30 | 2022-04-19 | Consumerinfo.Com, Inc. | Systems and methods for data verification |
US10437895B2 (en) | 2007-03-30 | 2019-10-08 | Consumerinfo.Com, Inc. | Systems and methods for data verification |
US8488751B2 (en) | 2007-05-11 | 2013-07-16 | Avaya Inc. | Unified messenging system and method |
US8856343B2 (en) | 2007-06-12 | 2014-10-07 | International Business Machines Corporation | Managing computer resources in a distributed computing system |
US8266287B2 (en) | 2007-06-12 | 2012-09-11 | International Business Machines Corporation | Managing computer resources in a distributed computing system |
US20080313331A1 (en) * | 2007-06-12 | 2008-12-18 | Boykin James R | Managing Computer Resources In A Distributed Computing System |
US7904476B1 (en) | 2007-07-30 | 2011-03-08 | Hewlett-Packard Develpment Company, L.P. | Computer-implemented method for compressing representation of binary relation |
US9405921B1 (en) | 2007-07-31 | 2016-08-02 | Hewlett Packard Enterprise Development Lp | Computer-implemented method for role discovery in access control systems |
US20090037870A1 (en) * | 2007-07-31 | 2009-02-05 | Lucinio Santos-Gomez | Capturing realflows and practiced processes in an IT governance system |
US9092380B1 (en) * | 2007-10-11 | 2015-07-28 | Norberto Menendez | System and method of communications with supervised interaction |
US11379916B1 (en) | 2007-12-14 | 2022-07-05 | Consumerinfo.Com, Inc. | Card registry systems and methods |
US9542682B1 (en) | 2007-12-14 | 2017-01-10 | Consumerinfo.Com, Inc. | Card registry systems and methods |
US9767513B1 (en) | 2007-12-14 | 2017-09-19 | Consumerinfo.Com, Inc. | Card registry systems and methods |
US10614519B2 (en) | 2007-12-14 | 2020-04-07 | Consumerinfo.Com, Inc. | Card registry systems and methods |
US9230283B1 (en) | 2007-12-14 | 2016-01-05 | Consumerinfo.Com, Inc. | Card registry systems and methods |
US10262364B2 (en) | 2007-12-14 | 2019-04-16 | Consumerinfo.Com, Inc. | Card registry systems and methods |
US10878499B2 (en) | 2007-12-14 | 2020-12-29 | Consumerinfo.Com, Inc. | Card registry systems and methods |
US20090205018A1 (en) * | 2008-02-07 | 2009-08-13 | Ferraiolo David F | Method and system for the specification and enforcement of arbitrary attribute-based access control policies |
US20090320092A1 (en) * | 2008-06-24 | 2009-12-24 | Microsoft Corporation | User interface for managing access to a health-record |
US11157872B2 (en) | 2008-06-26 | 2021-10-26 | Experian Marketing Solutions, Llc | Systems and methods for providing an integrated identifier |
US11769112B2 (en) | 2008-06-26 | 2023-09-26 | Experian Marketing Solutions, Llc | Systems and methods for providing an integrated identifier |
US10075446B2 (en) | 2008-06-26 | 2018-09-11 | Experian Marketing Solutions, Inc. | Systems and methods for providing an integrated identifier |
US10115155B1 (en) | 2008-08-14 | 2018-10-30 | Experian Information Solution, Inc. | Multi-bureau credit file freeze and unfreeze |
US9489694B2 (en) | 2008-08-14 | 2016-11-08 | Experian Information Solutions, Inc. | Multi-bureau credit file freeze and unfreeze |
US9792648B1 (en) | 2008-08-14 | 2017-10-17 | Experian Information Solutions, Inc. | Multi-bureau credit file freeze and unfreeze |
US11636540B1 (en) | 2008-08-14 | 2023-04-25 | Experian Information Solutions, Inc. | Multi-bureau credit file freeze and unfreeze |
US9256904B1 (en) | 2008-08-14 | 2016-02-09 | Experian Information Solutions, Inc. | Multi-bureau credit file freeze and unfreeze |
US10650448B1 (en) | 2008-08-14 | 2020-05-12 | Experian Information Solutions, Inc. | Multi-bureau credit file freeze and unfreeze |
US11004147B1 (en) | 2008-08-14 | 2021-05-11 | Experian Information Solutions, Inc. | Multi-bureau credit file freeze and unfreeze |
US8788681B1 (en) * | 2008-08-25 | 2014-07-22 | Symantec Corporation | Method and apparatus for autonomously managing a computer resource using a security certificate |
US10621657B2 (en) | 2008-11-05 | 2020-04-14 | Consumerinfo.Com, Inc. | Systems and methods of credit information reporting |
US20100185451A1 (en) * | 2009-01-16 | 2010-07-22 | Oracle International Corporation | Business-responsibility-centric identity management |
US9026456B2 (en) * | 2009-01-16 | 2015-05-05 | Oracle International Corporation | Business-responsibility-centric identity management |
US20110202384A1 (en) * | 2010-02-17 | 2011-08-18 | Rabstejnek Wayne S | Enterprise Rendering Platform |
US8789132B2 (en) | 2010-06-07 | 2014-07-22 | Oracle International Corporation | Enterprise model for provisioning fine-grained access control |
US9141442B1 (en) | 2010-09-08 | 2015-09-22 | Dell Software Inc. | Automated connector creation for provisioning systems |
US8903061B2 (en) | 2010-09-21 | 2014-12-02 | Hartford Fire Insurance Company | Storage, processing, and display of service desk performance metrics |
US8462922B2 (en) | 2010-09-21 | 2013-06-11 | Hartford Fire Insurance Company | Storage, processing, and display of service desk performance metrics |
US20120102201A1 (en) * | 2010-10-25 | 2012-04-26 | Hitachi, Ltd. | Storage apparatus and management method thereof |
US20120109701A1 (en) * | 2010-11-01 | 2012-05-03 | Bank Of America Corporation | Fulfillment Workflow Optimization |
US9684905B1 (en) | 2010-11-22 | 2017-06-20 | Experian Information Solutions, Inc. | Systems and methods for data verification |
US8429191B2 (en) | 2011-01-14 | 2013-04-23 | International Business Machines Corporation | Domain based isolation of objects |
US10230575B2 (en) | 2011-02-07 | 2019-03-12 | Nokia Technologies Oy | Method and apparatus for on-demand client-initiated provisioning |
US20120203824A1 (en) * | 2011-02-07 | 2012-08-09 | Nokia Corporation | Method and apparatus for on-demand client-initiated provisioning |
US8375439B2 (en) | 2011-04-29 | 2013-02-12 | International Business Machines Corporation | Domain aware time-based logins |
US9665854B1 (en) | 2011-06-16 | 2017-05-30 | Consumerinfo.Com, Inc. | Authentication alerts |
US11232413B1 (en) | 2011-06-16 | 2022-01-25 | Consumerinfo.Com, Inc. | Authentication alerts |
US11954655B1 (en) | 2011-06-16 | 2024-04-09 | Consumerinfo.Com, Inc. | Authentication alerts |
US10115079B1 (en) | 2011-06-16 | 2018-10-30 | Consumerinfo.Com, Inc. | Authentication alerts |
US10685336B1 (en) | 2011-06-16 | 2020-06-16 | Consumerinfo.Com, Inc. | Authentication alerts |
US9607336B1 (en) | 2011-06-16 | 2017-03-28 | Consumerinfo.Com, Inc. | Providing credit inquiry alerts |
US10719873B1 (en) | 2011-06-16 | 2020-07-21 | Consumerinfo.Com, Inc. | Providing credit inquiry alerts |
US10176233B1 (en) | 2011-07-08 | 2019-01-08 | Consumerinfo.Com, Inc. | Lifescore |
US11665253B1 (en) | 2011-07-08 | 2023-05-30 | Consumerinfo.Com, Inc. | LifeScore |
US10798197B2 (en) | 2011-07-08 | 2020-10-06 | Consumerinfo.Com, Inc. | Lifescore |
US20130060659A1 (en) * | 2011-09-02 | 2013-03-07 | Oracle International Corporation | System and method for splitting collaboration on event metrics for a supplier to respond to based on functional role |
US10642999B2 (en) | 2011-09-16 | 2020-05-05 | Consumerinfo.Com, Inc. | Systems and methods of identity protection and management |
US11790112B1 (en) | 2011-09-16 | 2023-10-17 | Consumerinfo.Com, Inc. | Systems and methods of identity protection and management |
US9542553B1 (en) | 2011-09-16 | 2017-01-10 | Consumerinfo.Com, Inc. | Systems and methods of identity protection and management |
US11087022B2 (en) | 2011-09-16 | 2021-08-10 | Consumerinfo.Com, Inc. | Systems and methods of identity protection and management |
US10061936B1 (en) | 2011-09-16 | 2018-08-28 | Consumerinfo.Com, Inc. | Systems and methods of identity protection and management |
US9972048B1 (en) | 2011-10-13 | 2018-05-15 | Consumerinfo.Com, Inc. | Debt services candidate locator |
US9536263B1 (en) | 2011-10-13 | 2017-01-03 | Consumerinfo.Com, Inc. | Debt services candidate locator |
US12014416B1 (en) | 2011-10-13 | 2024-06-18 | Consumerinfo.Com, Inc. | Debt services candidate locator |
US11200620B2 (en) | 2011-10-13 | 2021-12-14 | Consumerinfo.Com, Inc. | Debt services candidate locator |
US9853959B1 (en) | 2012-05-07 | 2017-12-26 | Consumerinfo.Com, Inc. | Storage and maintenance of personal data |
US11356430B1 (en) | 2012-05-07 | 2022-06-07 | Consumerinfo.Com, Inc. | Storage and maintenance of personal data |
US9081950B2 (en) | 2012-05-29 | 2015-07-14 | International Business Machines Corporation | Enabling host based RBAC roles for LDAP users |
US8938796B2 (en) | 2012-09-20 | 2015-01-20 | Paul Case, SR. | Case secure computer architecture |
US9122633B2 (en) | 2012-09-20 | 2015-09-01 | Paul Case, SR. | Case secure computer architecture |
US10021107B1 (en) | 2012-10-30 | 2018-07-10 | Citigroup Technology, Inc. | Methods and systems for managing directory information |
US20140122568A1 (en) * | 2012-10-30 | 2014-05-01 | Citigroup Technology, Inc. | Methods and Systems for Managing Directory Information |
US9544312B2 (en) * | 2012-10-30 | 2017-01-10 | Citigroup Technology, Inc. | Methods and systems for managing directory information |
US11012491B1 (en) | 2012-11-12 | 2021-05-18 | ConsumerInfor.com, Inc. | Aggregating user web browsing data |
US11863310B1 (en) | 2012-11-12 | 2024-01-02 | Consumerinfo.Com, Inc. | Aggregating user web browsing data |
US9654541B1 (en) | 2012-11-12 | 2017-05-16 | Consumerinfo.Com, Inc. | Aggregating user web browsing data |
US10277659B1 (en) | 2012-11-12 | 2019-04-30 | Consumerinfo.Com, Inc. | Aggregating user web browsing data |
US9189643B2 (en) | 2012-11-26 | 2015-11-17 | International Business Machines Corporation | Client based resource isolation with domains |
US11132742B1 (en) | 2012-11-30 | 2021-09-28 | Consumerlnfo.com, Inc. | Credit score goals and alerts systems and methods |
US11651426B1 (en) | 2012-11-30 | 2023-05-16 | Consumerlnfo.com, Inc. | Credit score goals and alerts systems and methods |
US12020322B1 (en) | 2012-11-30 | 2024-06-25 | Consumerinfo.Com, Inc. | Credit score goals and alerts systems and methods |
US10963959B2 (en) | 2012-11-30 | 2021-03-30 | Consumerinfo. Com, Inc. | Presentation of credit score factors |
US10366450B1 (en) | 2012-11-30 | 2019-07-30 | Consumerinfo.Com, Inc. | Credit data analysis |
US11308551B1 (en) | 2012-11-30 | 2022-04-19 | Consumerinfo.Com, Inc. | Credit data analysis |
US9830646B1 (en) | 2012-11-30 | 2017-11-28 | Consumerinfo.Com, Inc. | Credit score goals and alerts systems and methods |
US10255598B1 (en) | 2012-12-06 | 2019-04-09 | Consumerinfo.Com, Inc. | Credit card account data extraction |
US9830455B2 (en) | 2012-12-20 | 2017-11-28 | Bank Of America Corporation | Reconciliation of access rights in a computing system |
US10664312B2 (en) | 2012-12-20 | 2020-05-26 | Bank Of America Corporation | Computing resource inventory system |
US9536070B2 (en) | 2012-12-20 | 2017-01-03 | Bank Of America Corporation | Access requests at IAM system implementing IAM data model |
US10083312B2 (en) | 2012-12-20 | 2018-09-25 | Bank Of America Corporation | Quality assurance checks of access rights in a computing system |
US9529629B2 (en) | 2012-12-20 | 2016-12-27 | Bank Of America Corporation | Computing resource inventory system |
US9639594B2 (en) | 2012-12-20 | 2017-05-02 | Bank Of America Corporation | Common data model for identity access management data |
US10341385B2 (en) | 2012-12-20 | 2019-07-02 | Bank Of America Corporation | Facilitating separation-of-duties when provisioning access rights in a computing system |
US9558334B2 (en) | 2012-12-20 | 2017-01-31 | Bank Of America Corporation | Access requests at IAM system implementing IAM data model |
US20140289796A1 (en) * | 2012-12-20 | 2014-09-25 | Bank Of America Corporation | Reconciliation of access rights in a computing system |
US9537892B2 (en) | 2012-12-20 | 2017-01-03 | Bank Of America Corporation | Facilitating separation-of-duties when provisioning access rights in a computing system |
US9792153B2 (en) | 2012-12-20 | 2017-10-17 | Bank Of America Corporation | Computing resource inventory system |
US9529989B2 (en) | 2012-12-20 | 2016-12-27 | Bank Of America Corporation | Access requests at IAM system implementing IAM data model |
US10491633B2 (en) | 2012-12-20 | 2019-11-26 | Bank Of America Corporation | Access requests at IAM system implementing IAM data model |
US9477838B2 (en) * | 2012-12-20 | 2016-10-25 | Bank Of America Corporation | Reconciliation of access rights in a computing system |
US9483488B2 (en) | 2012-12-20 | 2016-11-01 | Bank Of America Corporation | Verifying separation-of-duties at IAM system implementing IAM data model |
US11283838B2 (en) | 2012-12-20 | 2022-03-22 | Bank Of America Corporation | Access requests at IAM system implementing IAM data model |
US9542433B2 (en) | 2012-12-20 | 2017-01-10 | Bank Of America Corporation | Quality assurance checks of access rights in a computing system |
US9916450B2 (en) | 2012-12-20 | 2018-03-13 | Bank Of America Corporation | Reconciliation of access rights in a computing system |
US9697263B1 (en) | 2013-03-04 | 2017-07-04 | Experian Information Solutions, Inc. | Consumer data request fulfillment system |
US9697568B1 (en) | 2013-03-14 | 2017-07-04 | Consumerinfo.Com, Inc. | System and methods for credit dispute processing, resolution, and reporting |
US11514519B1 (en) | 2013-03-14 | 2022-11-29 | Consumerinfo.Com, Inc. | System and methods for credit dispute processing, resolution, and reporting |
US10043214B1 (en) | 2013-03-14 | 2018-08-07 | Consumerinfo.Com, Inc. | System and methods for credit dispute processing, resolution, and reporting |
US9870589B1 (en) | 2013-03-14 | 2018-01-16 | Consumerinfo.Com, Inc. | Credit utilization tracking and reporting |
US11769200B1 (en) | 2013-03-14 | 2023-09-26 | Consumerinfo.Com, Inc. | Account vulnerability alerts |
US12020320B1 (en) | 2013-03-14 | 2024-06-25 | Consumerinfo.Com, Inc. | System and methods for credit dispute processing, resolution, and reporting |
US11113759B1 (en) | 2013-03-14 | 2021-09-07 | Consumerinfo.Com, Inc. | Account vulnerability alerts |
US10102570B1 (en) | 2013-03-14 | 2018-10-16 | Consumerinfo.Com, Inc. | Account vulnerability alerts |
US9406085B1 (en) | 2013-03-14 | 2016-08-02 | Consumerinfo.Com, Inc. | System and methods for credit dispute processing, resolution, and reporting |
US10929925B1 (en) | 2013-03-14 | 2021-02-23 | Consumerlnfo.com, Inc. | System and methods for credit dispute processing, resolution, and reporting |
US11164271B2 (en) | 2013-03-15 | 2021-11-02 | Csidentity Corporation | Systems and methods of delayed authentication and billing for on-demand products |
US11288677B1 (en) | 2013-03-15 | 2022-03-29 | Consumerlnfo.com, Inc. | Adjustment of knowledge-based authentication |
US10169761B1 (en) | 2013-03-15 | 2019-01-01 | ConsumerInfo.com Inc. | Adjustment of knowledge-based authentication |
US10740762B2 (en) | 2013-03-15 | 2020-08-11 | Consumerinfo.Com, Inc. | Adjustment of knowledge-based authentication |
US11775979B1 (en) | 2013-03-15 | 2023-10-03 | Consumerinfo.Com, Inc. | Adjustment of knowledge-based authentication |
US10664936B2 (en) | 2013-03-15 | 2020-05-26 | Csidentity Corporation | Authentication systems and methods for on-demand products |
US11790473B2 (en) | 2013-03-15 | 2023-10-17 | Csidentity Corporation | Systems and methods of delayed authentication and billing for on-demand products |
US20140289204A1 (en) * | 2013-03-19 | 2014-09-25 | International Business Machines Corporation | Executing a file backup process |
US9514003B2 (en) * | 2013-03-19 | 2016-12-06 | International Business Machines Corporation | Executing a file backup process |
US10685398B1 (en) | 2013-04-23 | 2020-06-16 | Consumerinfo.Com, Inc. | Presenting credit score information |
US11120519B2 (en) | 2013-05-23 | 2021-09-14 | Consumerinfo.Com, Inc. | Digital identity |
US10453159B2 (en) | 2013-05-23 | 2019-10-22 | Consumerinfo.Com, Inc. | Digital identity |
US11803929B1 (en) | 2013-05-23 | 2023-10-31 | Consumerinfo.Com, Inc. | Digital identity |
US9721147B1 (en) | 2013-05-23 | 2017-08-01 | Consumerinfo.Com, Inc. | Digital identity |
US9443268B1 (en) | 2013-08-16 | 2016-09-13 | Consumerinfo.Com, Inc. | Bill payment and reporting |
US10269065B1 (en) | 2013-11-15 | 2019-04-23 | Consumerinfo.Com, Inc. | Bill payment and reporting |
US10580025B2 (en) | 2013-11-15 | 2020-03-03 | Experian Information Solutions, Inc. | Micro-geographic aggregation system |
US10102536B1 (en) | 2013-11-15 | 2018-10-16 | Experian Information Solutions, Inc. | Micro-geographic aggregation system |
US10325314B1 (en) | 2013-11-15 | 2019-06-18 | Consumerinfo.Com, Inc. | Payment reporting systems |
US10025842B1 (en) | 2013-11-20 | 2018-07-17 | Consumerinfo.Com, Inc. | Systems and user interfaces for dynamic access of multiple remote databases and synchronization of data based on user rules |
US9477737B1 (en) | 2013-11-20 | 2016-10-25 | Consumerinfo.Com, Inc. | Systems and user interfaces for dynamic access of multiple remote databases and synchronization of data based on user rules |
US11461364B1 (en) | 2013-11-20 | 2022-10-04 | Consumerinfo.Com, Inc. | Systems and user interfaces for dynamic access of multiple remote databases and synchronization of data based on user rules |
US10628448B1 (en) | 2013-11-20 | 2020-04-21 | Consumerinfo.Com, Inc. | Systems and user interfaces for dynamic access of multiple remote databases and synchronization of data based on user rules |
US9529851B1 (en) | 2013-12-02 | 2016-12-27 | Experian Information Solutions, Inc. | Server architecture for electronic data quality processing |
US11107158B1 (en) | 2014-02-14 | 2021-08-31 | Experian Information Solutions, Inc. | Automatic generation of code for attributes |
US10262362B1 (en) | 2014-02-14 | 2019-04-16 | Experian Information Solutions, Inc. | Automatic generation of code for attributes |
US11847693B1 (en) | 2014-02-14 | 2023-12-19 | Experian Information Solutions, Inc. | Automatic generation of code for attributes |
USD759689S1 (en) | 2014-03-25 | 2016-06-21 | Consumerinfo.Com, Inc. | Display screen or portion thereof with graphical user interface |
USD760256S1 (en) | 2014-03-25 | 2016-06-28 | Consumerinfo.Com, Inc. | Display screen or portion thereof with graphical user interface |
USD759690S1 (en) | 2014-03-25 | 2016-06-21 | Consumerinfo.Com, Inc. | Display screen or portion thereof with graphical user interface |
US9892457B1 (en) | 2014-04-16 | 2018-02-13 | Consumerinfo.Com, Inc. | Providing credit data in search results |
US10482532B1 (en) | 2014-04-16 | 2019-11-19 | Consumerinfo.Com, Inc. | Providing credit data in search results |
US11587150B1 (en) | 2014-04-25 | 2023-02-21 | Csidentity Corporation | Systems and methods for eligibility verification |
US10373240B1 (en) | 2014-04-25 | 2019-08-06 | Csidentity Corporation | Systems, methods and computer-program products for eligibility verification |
US11074641B1 (en) | 2014-04-25 | 2021-07-27 | Csidentity Corporation | Systems, methods and computer-program products for eligibility verification |
US10521601B2 (en) | 2014-04-30 | 2019-12-31 | Sailpoint Technologies, Israel Ltd. | System and method for data governance |
US10127510B2 (en) | 2014-08-01 | 2018-11-13 | Oracle International Corporation | Aggregation-driven approval system |
US10630694B1 (en) | 2016-09-20 | 2020-04-21 | Express Scripts Strategic Development, Inc. | Systems and methods for data access control |
US11240252B2 (en) | 2016-09-20 | 2022-02-01 | Express Scripts Strategic Development, Inc. | Systems and methods for data access control |
US11681733B2 (en) | 2017-01-31 | 2023-06-20 | Experian Information Solutions, Inc. | Massive scale heterogeneous data ingestion and user resolution |
US11227001B2 (en) | 2017-01-31 | 2022-01-18 | Experian Information Solutions, Inc. | Massive scale heterogeneous data ingestion and user resolution |
US20200267108A1 (en) * | 2017-07-28 | 2020-08-20 | Chengdu Qianniucao Information Technology Co., Ltd. | Method for user/staff member to acquire mail box account in system |
US11632348B2 (en) * | 2017-07-28 | 2023-04-18 | Chengdu Qianniucao Information Technology Co., Ltd. | Method for acquiring mail box account in system |
US11588639B2 (en) | 2018-06-22 | 2023-02-21 | Experian Information Solutions, Inc. | System and method for a token gateway environment |
US10911234B2 (en) | 2018-06-22 | 2021-02-02 | Experian Information Solutions, Inc. | System and method for a token gateway environment |
US11399029B2 (en) | 2018-09-05 | 2022-07-26 | Consumerinfo.Com, Inc. | Database platform for realtime updating of user data from third party sources |
US11265324B2 (en) | 2018-09-05 | 2022-03-01 | Consumerinfo.Com, Inc. | User permissions for access to secure data at third-party |
US10880313B2 (en) | 2018-09-05 | 2020-12-29 | Consumerinfo.Com, Inc. | Database platform for realtime updating of user data from third party sources |
US10671749B2 (en) | 2018-09-05 | 2020-06-02 | Consumerinfo.Com, Inc. | Authenticated access and aggregation database platform |
US10963434B1 (en) | 2018-09-07 | 2021-03-30 | Experian Information Solutions, Inc. | Data architecture for supporting multiple search models |
US11734234B1 (en) | 2018-09-07 | 2023-08-22 | Experian Information Solutions, Inc. | Data architecture for supporting multiple search models |
US11315179B1 (en) | 2018-11-16 | 2022-04-26 | Consumerinfo.Com, Inc. | Methods and apparatuses for customized card recommendations |
US11842454B1 (en) | 2019-02-22 | 2023-12-12 | Consumerinfo.Com, Inc. | System and method for an augmented reality experience via an artificial intelligence bot |
US11238656B1 (en) | 2019-02-22 | 2022-02-01 | Consumerinfo.Com, Inc. | System and method for an augmented reality experience via an artificial intelligence bot |
US11941065B1 (en) | 2019-09-13 | 2024-03-26 | Experian Information Solutions, Inc. | Single identifier platform for storing entity data |
US11461677B2 (en) | 2020-03-10 | 2022-10-04 | Sailpoint Technologies, Inc. | Systems and methods for data correlation and artifact matching in identity management artificial intelligence systems |
US11308186B1 (en) | 2021-03-19 | 2022-04-19 | Sailpoint Technologies, Inc. | Systems and methods for data correlation and artifact matching in identity management artificial intelligence systems |
US11880377B1 (en) | 2021-03-26 | 2024-01-23 | Experian Information Solutions, Inc. | Systems and methods for entity resolution |
US12034729B2 (en) | 2021-10-11 | 2024-07-09 | Odna, Llc | System and method for computer system security authorization interfaces |
US12015527B1 (en) * | 2023-02-16 | 2024-06-18 | Google Llc | Extensible method for organizational mapping via cloud resource consumption |
Also Published As
Publication number | Publication date |
---|---|
US20020147801A1 (en) | 2002-10-10 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US6947989B2 (en) | System and method for provisioning resources to users based on policies, roles, organizational information, and attributes | |
US6985955B2 (en) | System and method for provisioning resources to users based on roles, organizational information, attributes and third-party information or authorizations | |
US6871232B2 (en) | Method and system for third party resource provisioning management | |
USRE46916E1 (en) | System and method for secure management of mobile user access to enterprise network resources | |
US7827598B2 (en) | Grouped access control list actions | |
US7475136B2 (en) | Method and apparatus for provisioning tasks using a provisioning bridge server | |
US9461892B2 (en) | System and method for serving and managing independent access devices | |
US6816871B2 (en) | Delivering output XML with dynamically selectable processing | |
Karjoth | Access control with IBM Tivoli access manager | |
US8015600B2 (en) | Employing electronic certificate workflows | |
US7840658B2 (en) | Employing job code attributes in provisioning | |
US7761306B2 (en) | icFoundation web site development software and icFoundation biztalk server 2000 integration | |
US7802174B2 (en) | Domain based workflows | |
US7363339B2 (en) | Determining group membership | |
US7512585B2 (en) | Support for multiple mechanisms for accessing data stores | |
US6453353B1 (en) | Role-based navigation of information resources | |
US7478407B2 (en) | Supporting multiple application program interfaces | |
US20050060572A1 (en) | System and method for managing access entitlements in a computing network | |
US20020143865A1 (en) | Servicing functions that require communication between multiple servers | |
WO2002061653A9 (en) | System and method for resource provisioning | |
JP2003150482A (en) | Contents filtering method, contents filtering device and contents filtering program | |
US7765285B2 (en) | Mail server, electronic mail transmission control method for the mail server, and electronic mail system | |
GB2378349A (en) | A system for managing a computer network | |
Zhou et al. | A Framework for Cross-Institutional Authentication and Authorisation | |
Aski | An Efficient Model for Data Security Management in Distributed Systems |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: IMPERIAL BANK, CALIFORNIA Free format text: SECURITY INTEREST;ASSIGNOR:ACCESS360;REEL/FRAME:011839/0172 Effective date: 20010522 |
|
AS | Assignment |
Owner name: ACCESS 360, CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:GULLOTTA, TONY J.;BOHREN, JEFFREY S.;CHEN, LIANGTONG;AND OTHERS;REEL/FRAME:011881/0292;SIGNING DATES FROM 20010328 TO 20010329 |
|
AS | Assignment |
Owner name: INTERNATIONAL BUSINESS MACHINES CORPORATION, NEW Y Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:ACCESS360;REEL/FRAME:013365/0160 Effective date: 20021213 |
|
STCF | Information on status: patent grant |
Free format text: PATENTED CASE |
|
AS | Assignment |
Owner name: ACCESS360, CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:COMERICA BANK;REEL/FRAME:020491/0666 Effective date: 20080207 |
|
FPAY | Fee payment |
Year of fee payment: 4 |
|
REMI | Maintenance fee reminder mailed | ||
FPAY | Fee payment |
Year of fee payment: 8 |
|
SULP | Surcharge for late payment |
Year of fee payment: 7 |
|
FPAY | Fee payment |
Year of fee payment: 12 |
|
AS | Assignment |
Owner name: ACCESS360, CALIFORNIA Free format text: CORRECTIVE ASSIGNMENT TO CORRECT THE ATTACHMENT PREVIOUSLY RECORDED AT REEL: 020491 FRAME: 0666. ASSIGNOR(S) HEREBY CONFIRMS THE RELEASE OF THE SECURITY INTEREST;ASSIGNOR:COMERICA BANK;REEL/FRAME:043095/0950 Effective date: 20080207 |